AML compliance: Why failure is not an option

The following three cases are examples of recent BSA enforcement actions imposed after organizations failed to hire enough staff and follow proper procedures to ensure AML compliance:

• In 2022, a $140,000,000 civil penalty was imposed against USAA FSB. The consent order found that while USAA FSB had significant growth, it failed to match that growth with AML compliance efforts. The order also cited significant understaffing and the use of third-party contractors who were not adequately trained or lacked qualifications and expertise. Due to case management system deficiencies the institution had a backlog of around 90,000 alerts and 6,900 cases, with those numbers expected to grow before the bank could begin addressing the backlog. These numbers demonstrate the negative consequences of a failure to hire appropriate staff.
• In 2021, an $8,000,000 civil penalty was imposed against CommunityBank of Texas N.A. The consent order noted that the institution needed to implement an adequate AML program, citing an understaffed AML compliance department that had analysts reviewing an average of 100 daily case alerts. The volumes did not allow time to review supporting documents, such as check images, wire details, etc. The analysts performed quality control with no objective or third-party perspective. The consent order also cited exemptions applied by the BSA Officer for customers whose activity was considered “well-known” to reduce the number of alerts requiring review. The exemptions were not appropriately documented, and the exempted customers included individuals later arrested for financial crimes.
• In 2021, a $390,000,000 civil penalty was imposed against Capital One N. A. The consent order noted violated BSA requirements related to its Check Cashing Group, a product of several acquisitions which included a customer base of check cashers and existed between 2006 and 2014. Although these customers were subjected to regular reviews, the reviews relied heavily on comparison to past activity, citing consistent behavior without further investigating potentially suspicious activity. When AML compliance analysts identified suspicious activity such as a “medical fraud ring,” “excessive corporate check cashing,” or “structured third-party checks,” they were instructed to contact relationship managers, who would provide vague or implausible explanations, at times accepted as justification. The customer (check casher), given the highest risk rating by the bank, was ultimately convicted of conspiring to commit money laundering related to loan sharking and illegal gambling proceeds and was connected to the Genovese organized crime family. The bank was made aware of criminal investigations/charges against other group customers yet failed to identify suspicious activity or file timely SARs on the clients.  In addition, the consent order noted a failure to identify armored car cash shipments as real cash, resulting in approximately 50,000 transactions (over $16 billion) going unreported through CTR filings.

Each AML compliance case listed above involved a failure to file timely SARs or report suspicious activity due to weaknesses in their AML programs. In many cases, the weaknesses were identified during previous regulatory reviews, and the institutions could have adjusted the program or corrected the deficiencies to avoid backlash.