You're facing a deficiency letter. Your transaction monitoring system flagged 40% fewer alerts than expected by regulators, and your case management backlog stretches back nine months. The question isn't whether you need to upgrade your AML infrastructure, it's how.
Bank of America's $1.2 billion fine for "deficient and ineffective" AML processes and "egregious and continued" violations of the Bank Secrecy Act highlights the stakes. When your monitoring framework fails, regulators won't accept "we're working on it" as an answer.
You have three options: build a custom system internally, buy a commercial platform, or partner with a managed service provider. Each choice carries distinct obligations under the Bank Secrecy Act, different technology requirements, and varying levels of regulatory risk. Here's how to choose.
The Decision You're Facing
Your AML monitoring infrastructure must meet specific BSA requirements: detect suspicious patterns, generate Suspicious Activity Reports (SARs) within required timeframes, and maintain audit trails proving compliance. The question is who owns the technology stack, who tunes the detection rules, and who bears the compliance risk when something goes wrong.
This isn't just a technical decision. Your choice affects your examination posture with the FFIEC BSA/AML Examination Manual, impacts your ability to respond to emerging typologies, and influences how quickly you can address deficiencies if regulators find gaps.
Key Factors That Affect Your Choice
Transaction volume and complexity. If you process fewer than 50,000 transactions monthly with straightforward payment flows, your needs differ from a bank moving $2 billion daily across correspondent networks and trade finance channels.
Current deficiency status. Are you operating under a consent order? Do you have open findings from your last examination? If regulators have already flagged your AML program as deficient, you don't have time to build from scratch.
In-house technical depth. Building requires data engineers who understand graph databases, data scientists who can tune machine learning models without creating excessive false positives, and compliance analysts who can translate regulatory requirements into detection logic. Most institutions overestimate this capability.
Regulatory expectations for your charter type. Community banks face different scrutiny than money center banks. Your asset size, customer base, and product mix determine whether examiners will accept a vendor solution or expect proprietary capabilities.
Path A: Build Your Own System
Choose this path when:
You're a large institution ($50 billion+ in assets) with complex, high-volume transaction flows that commercial platforms struggle to monitor effectively. You have a dedicated financial crimes technology team with proven expertise in AML systems architecture. Your board has approved multi-year investment in both development and ongoing maintenance.
What this requires:
You'll need to satisfy FFIEC guidance on model risk management if you're using machine learning for detection. Your development process must include compliance review at every stage, not as a final check, but as an integrated control. Document every design decision affecting BSA compliance. When examiners ask why your system didn't flag a particular pattern, you need to show the risk assessment that justified your approach.
Your infrastructure must support real-time or near-real-time monitoring depending on your risk profile. Batch processing that runs overnight won't satisfy current regulatory expectations for high-risk scenarios. You'll need data feeds from core banking, wire platforms, ACH systems, and any other channel where money moves.
The regulatory risk:
You own every deficiency. If your custom rules miss a structuring pattern that a commercial system would have caught, examiners won't accept "our system was designed differently" as justification. You're betting that your internal team can stay ahead of evolving typologies better than vendors who aggregate intelligence across hundreds of institutions.
Path B: Buy a Commercial Platform
Choose this path when:
You need proven detection capabilities quickly, you want to use vendor expertise in rule tuning, or you're remediating existing deficiencies and need to demonstrate rapid improvement. Your institution has standard transaction flows that fit within common monitoring scenarios.
What this requires:
Don't assume the vendor's default configuration meets your BSA obligations. You must validate that detection scenarios cover your specific risks. If you operate in high-risk geographies, offer money services, or serve industries prone to money laundering, the out-of-box rules won't suffice.
Plan for a 6-12 month implementation even with a commercial system. Data integration takes longer than vendors estimate. Your team needs to understand how the system's detection logic works, not just how to use the interface. When examiners ask why you didn't catch something, "the system didn't alert" isn't an acceptable answer.
Budget for ongoing tuning. Your false positive rate will be unacceptable if you don't adjust thresholds based on your actual transaction patterns. This requires dedicated resources who understand both the technology and your customer base.
The regulatory risk:
You still own the compliance outcome. Examiners will ask whether you validated the vendor's detection capabilities, how often you review system performance, and whether you're tuning rules based on identified gaps. The FFIEC BSA/AML Examination Manual is clear: you can't outsource accountability.
Path C: Partner With a Managed Service Provider
Choose this path when:
You're a smaller institution (under $10 billion in assets) without the resources to maintain specialized AML technology staff, you're operating under regulatory pressure to remediate quickly, or you need to free internal teams to focus on investigations rather than system administration.
What this requires:
Your due diligence must be exhaustive. Review the provider's SOC 2 reports, understand their staff qualifications, and verify their track record with institutions similar to yours. Ask specific questions: How quickly do they update detection rules when new typologies emerge? What's their average SAR filing timeline? How do they handle system outages?
You'll need clear contractual terms about who does what. The provider might run the monitoring platform and generate alerts, but your team typically reviews cases and files SARs. Define escalation procedures, reporting requirements, and performance metrics.
Maintain internal expertise even with a managed service. You need staff who can evaluate whether the provider's approach meets your risk profile and who can answer examiners' questions about your monitoring strategy.
The regulatory risk:
Examiners will scrutinize your vendor management framework. You must demonstrate ongoing oversight: quarterly business reviews, performance metrics, periodic testing of detection capabilities. If the provider misses suspicious activity, you bear the enforcement risk. The BSA doesn't recognize "our vendor didn't catch it" as a defense.
Summary Matrix
| Factor | Build | Buy | Partner |
|---|---|---|---|
| Best for asset size | $50B+ | $1B-$50B | Under $10B |
| Time to full operation | 18-36 months | 6-12 months | 3-6 months |
| Ongoing technical staff needed | 10-20+ FTEs | 3-5 FTEs | 1-2 FTEs |
| Regulatory examination focus | System design decisions | Tuning and validation | Vendor oversight |
| Ability to customize | Complete control | Moderate | Limited |
| Cost to remediate deficiencies | Highest | Moderate | Lowest |
| Regulatory accountability | You own everything | You own outcomes | You own outcomes |
The common thread across all three paths: you can't outsource your BSA compliance obligation. Whether you build, buy, or partner, you must demonstrate that you understand what your system does, why it's calibrated the way it is, and how you know it's working. That's what Bank of America's $1.2 billion fine teaches us, inadequate monitoring infrastructure isn't a technology problem. It's a compliance failure with quantifiable consequences.
