Tuned to miss

A monitoring system sized to its staff

On 13 October 2026, FinCEN issued a consent order against Bank of America, N.A., assessing a $450 million civil money penalty, and the OCC issued a companion order the same day carrying a further $750 million, roughly $1.2 billion in total. Unusually, the bank admitted the stated facts and violations rather than neither admitting nor denying them. FinCEN found that from at least January 2018 through July 2025, the second largest bank in the United States willfully failed to implement and maintain an anti-money-laundering program that met the Bank Secrecy Act's minimum requirements.

At the center of the failure sits a piece of technology with a bland name and an outsized role: Event Processor, the bank's proprietary transaction-monitoring system, known internally as EP. EP decided what suspicious activity got investigated and what did not, and FinCEN found that its core design choices were not grounded in the risks the bank actually faced. The consequence was blunt. More than $5 billion in suspicious activity was missed or detected late, including roughly $1 billion tied to national-security and other priority risks, among them transactions consistent with Chinese Money Laundering Network typologies and more than $600 million bearing indicators of potential trade-based money laundering, about one in three of those with a nexus to the southwest border.

The order is not, at its heart, a story about criminals outsmarting a bank. It is a story about a detection system that was calibrated to the capacity of the team meant to work its output, rather than to the risk it was supposed to catch, and about an institution that kept that system in place, and overruled its own compliance staff, long after the warnings arrived. FinCEN found a willful program failure; it does not find that the bank set out to launder money. What it describes is subtler and, for a compliance audience, more instructive: how a monitoring program can be quietly tuned to miss.

Inside Event Processor

EP worked by scoring activity and investigating what scored high enough. An item had to reach a 20-point threshold to generate a case, and EP could aggregate alerts into a single Event Group over a period as long as 13 months before any human looked at it. Two design choices in that sentence did most of the damage. The threshold decided how much suspicious behaviour was worth a human's time, and the aggregation window decided how long the bank could let activity accumulate before deciding. Set the threshold high and the window long, and a great deal of genuinely suspicious activity sits below the line, pooling quietly, uninvestigated.

FinCEN found that the scores themselves were not anchored in reality. Many of EP's risk-factor weights were, in the order's words, largely unsubstantiated, assigned without empirical support and not calibrated to how often a given factor actually produced a suspicious-activity report. The clearest illustration: the bank's own testing found one risk factor with a SAR yield of nearly 57 percent, meaning it flagged genuinely reportable activity more than half the time, and EP weighted it a single point. Internal reports in 2019 and 2020 documented this lack of correlation between weights and outcomes. The weights were not meaningfully updated, and the testing findings were not acted on.

On top of the thresholds and weights sat rules that the bank used to rescore or suppress activity, pushing items below the investigation line or out of the queue entirely, and FinCEN found these were applied without sufficient governance or oversight. Coverage had holes as well: EP barely monitored negotiable-instrument deposits, covering only certain purchases rather than deposits, and credit-card monitoring missed emerging typologies, including spending that routinely exceeded a cardholder's stated income. The cumulative effect is captured in one statistic. For multiple years, more than one in three of the bank's suspicious-activity investigations were prompted not by EP but by law enforcement, other banks, or internal manual referrals. A monitoring system that generates fewer than two-thirds of its own leads is not the primary control; it is a backstop to everyone else's.

The reason the system was built this way is the most telling detail of all. EP was designed, in part, because there were not enough investigators to work the alerts that simpler detection was generating. The threshold, in other words, was set to the size of the team, not the size of the risk. When the bank finally began to remediate, it estimated that fixing EP would roughly double its case volume and require about 750 additional investigators, which is a measure of how much risk the old calibration had been suppressing all along.

The activity below the threshold

The abstraction becomes concrete in the customers the system failed to stop. The order details streams of suspicious money flowing through accounts the bank's own compliance staff had flagged, in some cases repeatedly, for years.

The scale of what the threshold hid was quantified by the bank's own remediation. After the prudential regulators pushed it to lower the 20-point threshold to 10 or 12 points in December 2023, and to cut the aggregation window from 13 months to four, Bank of America ran a one-time lookback under the new parameters. It found that it had failed to identify and file roughly 8,900 suspicious-activity reports, covering nearly $4 billion in transaction activity, that the old settings would have left uninvestigated. That is a near-direct measurement of how much risk lived just below the line.

When the control is set to the budget

The deepest lesson of the Bank of America order is a warning about a specific and seductive failure mode: calibrating a detection control to the capacity available to respond to it. A transaction-monitoring threshold is supposed to be a statement about risk, a line above which activity is suspicious enough to warrant a look. When it becomes a statement about resources, a line set so that the number of cases stays within what the investigations team can handle, it stops measuring risk at all. It measures headcount. Everything above the line gets worked; everything below it, however suspicious, is defined out of existence. The order's finding that EP was built because there were not enough investigators is the purest form of this inversion, and the 750-person remediation estimate is its price.

Two further choices turned a mis-set threshold into a systemic blind spot. The first was the unsubstantiated weighting. A monitoring model is only as good as the relationship between its scores and real outcomes, and when a factor that produces a reportable result more than half the time is worth a single point, the model is not measuring suspicion, it is diluting it. The second was the use of suppression and rescoring rules without governance, which let the bank move activity below the line by fiat rather than by evidence. Together they meant that even activity that should have scored high could be scored down, and activity that pooled below the threshold was never reconsidered. The absence, for a long period, of any objective false-negative benchmark, a defined tolerance for how much suspicious activity the system was allowed to miss, meant no one was measuring the cost of the calibration.

Then there is the governance failure that should trouble any board. The order describes testing that did not test the right thing, focusing on statistical comparisons of SAR yield rather than on the significance and growing volume of activity being missed below the threshold. More pointedly, it records that when an internal test produced an unfavorable result that threatened the status quo, the then-Global Head of Financial Crimes directed a senior manager to repeat the test, and a more favorable result was achieved. A control-testing function that can be asked to run the test again until it passes is not an independent check; it is a ratification process. That is how a program keeps a failing system in place through years of its own warnings.

The customer examples close the loop, because they show the human escalations failing alongside the automated ones. Compliance staff recommended closing a fraud-riddled account and were overruled in favor of a mitigation plan; a customer's risk rating stayed Standard until a subpoena forced the issue; a warning from a money-services business about structured deposits produced no change; a customer's public disclosure of a DOJ money-laundering investigation produced no change. When both the model and the people are telling an institution that a relationship is dangerous, and the institution keeps the relationship and the calibration, the failure is no longer technical. It is a decision, repeated.

Calibrate to the risk, not the roster

The first and governing lesson is that a monitoring threshold must be justified against risk and outcomes, never against investigative capacity. If a firm cannot work the alerts that a risk-appropriate threshold generates, the answer is to add capacity or to restrict the risk, not to raise the threshold until the queue is comfortable. A program should be able to show that its thresholds and scenario parameters were set from the risk and the data, with a documented rationale, and that resourcing follows that calibration rather than driving it. A threshold set to the roster is the single most consequential error in this order.

The second is that risk weights and scenarios need empirical substantiation and a false-negative benchmark. Every factor in a scoring model should be tied to its observed outcome, its real suspicious-activity yield, and factors that produce reportable activity should carry weight proportional to that yield. Just as important, the firm should define a tolerance for missed activity and test against it, sampling below the threshold to measure what is being let through. A model that is only ever tested above the line cannot discover what it is missing, which is precisely the gap the Bank of America lookback exposed.

The third is that suppression, rescoring, and threshold changes require governance, documentation, and independent challenge. Any rule that moves activity below the investigation line, or that reduces case volume, is a risk-acceptance decision and should be governed as one, with evidence, approval, and monitoring of its effect. And the testing function that evaluates all of this has to be genuinely independent, protected from the pressure to produce a convenient answer. A simple safeguard the order all but writes for itself: an unfavorable test result may not be re-run to obtain a better one without documented, independent oversight of why.

The fourth is coverage and escalation. Monitoring has to reach the products and instruments where the risk actually moves, negotiable instruments and money orders, credit-card activity inconsistent with stated income, high-risk geographies, not just the channels that are easy to model. And when compliance recommends exiting a relationship, or when external warnings and a customer's own disclosures signal elevated risk, those escalations need a path that can actually change the outcome. A program where closure recommendations are routinely converted into mitigation plans, and where a subpoena is what finally moves a risk rating, is a program whose escalation path does not lead anywhere.

Each maps to a specific finding in the order, and each is a question a firm can put to its own monitoring program now, rather than discovering the answer in a lookback that measures the risk in billions.

The company a billion-dollar order keeps

Program-level BSA failures at large institutions share a grammar: a monitoring or oversight system that was not fit for the risk, warnings that went unheeded, and a penalty measured in hundreds of millions or billions. These three show the pattern across very different firms.

What links a money-services firm, a European bank's branch, and the second largest bank in the United States is that the obligation is identical: build a program that actually detects and reports, and act on what it and your own people tell you. The penalties scale with how long the failure ran and how much went unreported, not with whether the institution meant any harm.

Where supervision is pressing next

The Bank of America order crystallizes a supervisory shift that has been building for years: regulators are looking past whether a monitoring system exists to whether it is calibrated to the institution's actual risk. The era of crediting a firm for having a sophisticated, proprietary transaction-monitoring engine is over; what matters now is whether the thresholds are justified, the weights substantiated, the suppression rules governed, and the misses measured. FinCEN's willingness to detail the internals of Event Processor, down to a specific risk factor's SAR yield and the re-running of an unfavorable test, is a signal that the model itself, and the governance around it, is now squarely within examination scope.

A second theme is the refusal to accept resourcing as an excuse. The order treats the decision to calibrate detection to investigative capacity not as a practical compromise but as a program failure, and it quantifies the suppressed risk in the 750 investigators that remediation required. For any institution tempted to manage alert volume by raising thresholds, the message is explicit: the regulator will read a threshold set to the roster as a decision to not look, and will price it accordingly. The companion nature of the orders, FinCEN and the OCC acting together for a combined $1.2 billion, underscores that the prudential and financial-intelligence regulators are aligned on this.

Underneath both is the oldest theme in this field, which is that warnings have to change outcomes. The most damning passages of the order are not about technology; they are about a bank that saw the risk, in its testing, in its compliance recommendations, in subpoenas and external alerts and a customer's own public disclosure, and kept the calibration and the customers anyway. For any firm reading this as a forecast, the durable lesson is to build detection from the risk rather than the budget, to measure what the system misses as rigorously as what it catches, and to ensure that when the model or the people raise an alarm, something is actually able to change.

The agent that answers the backlog

The most quietly alarming number in this order is not the $1.2 billion or the $5 billion. It is 750, the additional investigators Bank of America estimated it would need to work the alerts a properly calibrated Event Processor would generate. That figure is the measure of how much looking the old threshold had been avoiding, and it is also, almost exactly, the pressure point that the industry's newest tool is being sold to relieve. As firms read this order as a forecast, the obvious question is what they will do with their own version of that 750, and increasingly the answer on offer is an AI agent.

The pitch is seductive and, in parts, sincere. Alert backlogs are enormous, false-positive rates routinely exceed ninety percent, experienced investigators are scarce and costly, and a capable agent can read a case file, assemble the transaction history and adverse media, assess the typology, draft the suspicious-activity narrative, and dispose of an alert in seconds. To a compliance leader facing a queue that would take 750 hires to clear, an agent that promises to do the reading looks less like software and more like relief. The agentic variety goes a step beyond the scoring model this order describes: it does not merely flag, it decides, and it can be pointed at the entire queue at once.

The danger is not the technology. It is the job the technology is asked to do, and this order is the sharpest possible illustration of why. Event Processor was itself an attempt to manage alert volume with capacity the bank did not have, and the result was a system calibrated to the roster rather than the risk. An AI agent introduced for the same reason, to make an unmanageable queue manageable without confronting the calibration or the resourcing beneath it, does not escape that logic. It industrializes it. There are two very different deployments hiding under a single name, and they point in opposite directions.

Deployed as augmentation, an agent attacks the genuinely mechanical work that drains skilled people, the data gathering and the first-draft narrative, and leaves the judgment, the escalation, and the close decision with a human. Used this way it does not shrink the number of people looking at risk; it changes what they spend their hours on, and it can be the precise opposite of the Event Processor failure, a multiplier that lets a firm investigate more of its risk rather than define more of it away. Deployed as auto-disposition, the same agent clears the queue by closing alerts, and every pathology FinCEN found in EP reappears, faster, larger, and harder to see. The sections that follow take the order's own findings and read them forward into that second deployment, because that is where the next billion-dollar order is most likely to come from.

The same failure, at machine speed

What makes this order such a useful lens on AI is that FinCEN did not describe an exotic fraud. It described a set of ordinary governance failures in a scoring system, and each of them has a direct analogue in an agent pointed at the wrong job. Naming them is the fastest way to see where the risk concentrates, because the order has, in effect, already written the risk assessment.

And the agent miscalibrates in its own ways

Start with calibration, because the comforting assumption is that an AI agent escapes the problem at the center of this order, and it does not. An agent that triages or disposes of alerts has a decision boundary just as surely as Event Processor had its 20-point line. It is simply implicit, expressed as a confidence threshold for auto-closing, a prompt that defines how suspicious is suspicious enough, and a model whose probability estimates may be poorly calibrated to begin with. Large models are frequently overconfident, assigning high certainty to conclusions that are wrong, and an overconfident agent closes alerts it should have escalated with exactly the assurance that makes a reviewer trust it. The firm has not removed the threshold problem. It has moved the threshold somewhere no one can see it, read it, or sign off on it.

Worse, that hidden boundary does not stay put. A numeric threshold is at least stable until someone changes it, and the change leaves a record. An agent's effective decision boundary is emergent, and it shifts whenever the underlying model is updated, the prompt is edited, the retrieval data changes, or the vendor ships a new version. A model upgrade marketed as an improvement can quietly recalibrate a firm's AML control overnight, moving the line that decides what gets investigated without a single governance committee being told. Bank of America at least knew where its threshold sat and made a deliberate decision to lower it in December 2023; a firm running an agent can have its close-line move repeatedly, in directions it never chose, and discover the drift only in a lookback.

Then there is what the agent does to the people around it. The standard defense of these systems is that a human stays in the loop, but automation bias is well documented: when a confident machine proposes a disposition, humans tend to accept it, and the more often the agent is right on easy cases, the more reflexively its judgment is ratified on hard ones. A human in the loop who approves thousands of agent closures a week is not a check; they are a rubber stamp with a job title. Over time the effect compounds, because investigators who no longer work alerts from scratch lose the pattern recognition that lets a person catch what a model misses, and the institution's independent capacity to detect quietly atrophies. This order already contains the human-failure version, compliance staff overruled and risk ratings left untouched; an over-trusted agent reaches the same place without anyone having to be overruled at all.

Scale is usually sold as the advantage, and it is also the danger. A team of human investigators makes uncorrelated errors, because different people miss different things and the misses are scattered. A single agent, or a fleet of identical copies of one agent, makes the same error in the same way across every alert it touches, all at once. One miscalibrated prompt, one flawed model update, one blind spot in the training data becomes a systemic failure that fires on millions of transactions simultaneously, with no diversity of judgment to catch it. The $5 billion Bank of America missed accumulated over years through a static system; a miscalibrated agent can open a gap that wide inside a single reporting period, because it applies one flawed view to everything at machine speed.

The quality of the agent's output can itself be a trap. A language model is built to produce fluent, plausible text, and a disposition rationale or a draft suspicious-activity narrative that reads as thorough and well-reasoned can be exactly that on the surface and wrong underneath, citing facts that are not in the record or reasoning from patterns that do not apply. This is more dangerous than a blank field, because a blank field invites scrutiny while a confident, articulate narrative passes quality assurance precisely because it looks like the work was done. A reviewer sampling closed alerts sees competent write-ups and moves on; the file looks reviewed, and looking reviewed is not the same as having been analysed. The order faulted testing that measured the wrong thing, and an agent that manufactures convincing paperwork makes it even easier to keep measuring the wrong thing.

The incentives around these tools pull in the wrong direction too. Agents are adopted to cut cost and clear backlogs, and the metrics that justify them, alerts closed per hour, false-positive reduction, cost per case, all reward disposition over detection. When an agent is tuned or selected against those metrics, the optimization pressure runs toward closing more alerts, which is the capacity-driven calibration of this order re-expressed as an explicit objective. A system rewarded for making work go away will, if nothing counterweights it, learn to make suspicious activity go away, and it will do so efficiently enough that the savings look like success right up until the lookback. The discipline that prevents this, a false-negative measure that makes a missed report costly, is precisely the discipline the order found absent.

Finally, accountability for all of this tends to fall through the cracks. An AML agent sits awkwardly between functions: the model-risk team treats it as software, the vendor-management team treats it as a procurement, the compliance team treats it as someone else's model, and no one owns its calibration the way a named officer must own a threshold. The reasoning behind any given close is often ephemeral, reconstructed after the fact rather than logged as it happened, which can leave the firm unable to show an examiner why an alert was dismissed, the one thing BSA supervision reliably demands. When FinCEN asks who decided not to investigate a relationship, that the agent did is not an answer the Bank Secrecy Act recognises, and a program that cannot name an accountable human behind its dispositions has recreated the governance vacuum at the heart of this order, only harder to see.

Beneath all of this sits the failure this order is really about. The most dangerous use of an AML agent is to justify not adding the capacity a risk-appropriate program requires, because that recreates the exact condition FinCEN and the OCC have now priced at $1.2 billion: detection sized to the staff rather than the risk. And the automated version is worse than the human one in a specific and under-appreciated way. When a threshold is set too high, the missed activity at least pools where a lookback can later find it, as Bank of America's did, roughly 8,900 unfiled reports and nearly $4 billion surfacing the moment the parameters changed. When an agent silently closes those same alerts instead, the activity is not pooled below a visible line. It is marked resolved, with a plausible narrative attached, and the lookback that would have found it may never be run.

AI does not get a pass

Firms sometimes treat AI as a regulatory frontier where the rules are not yet written. They are written. A monitoring system that uses AI is a model, and it sits inside the model-risk-management expectations U.S. regulators set out more than a decade ago in SR 11-7 and OCC Bulletin 2011-12: sound development, independent validation, effective challenge, and thorough documentation. Those expectations already reach AML models, and nothing about an agent's sophistication exempts it. If anything, this order raises the bar, because FinCEN went to the trouble of examining EP's internals, down to a single risk factor's SAR yield and the re-running of an unfavorable test, and signalled that the model and the governance around it are squarely within examination scope. An agent that disposes of alerts will be read the same way, and its reasoning will be the examiner's first request.

The hard legal edges have not moved either. A suspicious-activity report is a legal filing that rests on a judgment, and the obligation to make that judgment, and to defend the decision to file or not file, stays with the institution and the people accountable for it. An agent can inform that decision; it cannot own it. And the central holding of this matter, reinforced by U.S. Bank before it, applies with full force to anything automated: calibrating detection to capacity rather than to risk is a program failure, whether the calibration is a threshold a human set or a disposition policy encoded in an agent. The regulator will not care whether the miss was manual or automated. It will care that the activity was missed.

The firms that get this right will treat an AML agent as a high-impact model and a high-stakes control at the same time. Calibration follows risk, never capacity: an agent may let a firm work its alerts far more efficiently, but it must never become the reason the firm decides to look at less of its risk. A human owns every consequential disposition and every SAR decision, with a documented, auditable rationale, and the agent is held to augmentation on anything that closes risk. Validation measures what the agent clears, not only what it catches, through a defined false-negative tolerance, sampling below the line, and back-testing against emerging typologies. And the whole apparatus sits under genuine model governance: a model inventory with a named owner, drift monitoring, change control over prompts and data, red-teaming against evasion, and a testing function with the independence to deliver an unfavorable result and have it stand, which is the one safeguard whose absence this order made famous.

Each of these is the Bank of America order read forward. The bank's failure was not an absent control; it was a capable system aimed at managing volume rather than catching risk, with misses no one was measuring. An AI agent can be the tool that finally lets a firm investigate all of its risk, or the tool that lets it stop looking with more conviction than ever. The difference is governance, and the moment to build it is before the agent is embedded in the queue, not in the lookback that measures the gap in billions.