Scope
This guide examines the risks of optimizing transaction-monitoring systems for cost reduction instead of focusing on detecting suspicious activity. It's intended for AML compliance officers, fintech risk teams, and anyone involved in tuning monitoring thresholds or staffing investigation teams.
You'll find detailed requirements, guidance tied to the Bank Secrecy Act and FFIEC BSA/AML Examination Manual, and a reference table to evaluate your system's design choices.
Key Concepts
SAR yield: The percentage of investigated cases that result in a Suspicious Activity Report. A high SAR yield means your investigators spend less time on cases that don't warrant filing. It doesn't mean you're catching all suspicious activity.
Event scoring model: A system that assigns points to transaction alerts, triggering an investigation when a customer's cumulative score crosses a threshold. Bank of America's Event Processor used a 20-point threshold; alerts carried weights from zero to 20 points, and points expired after 13 months.
Permissible SAR loss: An invented justification for accepting fewer filings after a system recalibration. Bank of America's 2021 recalibration cut more than 8,200 cases and acknowledged a "SAR loss" it called "permissible" without any objective benchmark for tolerable loss.
Tolerance for missed activity: A stated acceptable rate for suspicious activity your system fails to detect. Bank of America set a 5% tolerance in late 2023. This practice is inadvisable because it shows a willingness to miss reportable activity.
Requirements Breakdown
Bank Secrecy Act Obligations
The Bank Secrecy Act requires you to file a SAR when you know, suspect, or have reason to suspect that a transaction involves illegal funds, is designed to evade regulations, lacks a business purpose, or uses the institution to facilitate criminal activity.
Your monitoring system should surface these transactions. If you tune it to reduce investigations, you're still obligated to file for the activity you stop reviewing.
FFIEC BSA/AML Examination Manual Expectations
The FFIEC BSA/AML Examination Manual expects your transaction-monitoring system to be risk-based and regularly validated. Examiners look for:
- Adequate coverage: Your system should monitor the risks your institution faces, not just those your current staffing can handle.
- Validation testing: Test whether your thresholds and scoring weights correlate with suspicious activity.
- Remediation of identified gaps: Fix problems revealed by testing, don't just document them.
Fincen's consent order against Bank of America criticized the bank for focusing "on the impact to the bank's resourcing rather than remediation sufficient to address the relevant issues" after internal tests showed the system was missing suspicious activity.
What Counts as a Financial Gain from Violations
Fincen considered the "hundreds of millions of dollars" in compliance spending Bank of America likely saved as a financial gain from its violations. If you reduce your investigator headcount or avoid hiring additional staff by tuning your system to generate fewer alerts, regulators may treat the avoided cost as an aggravating factor when calculating penalties.
Implementation Guidance
Don't Optimize for SAR Yield
SAR yield shows what percentage of your investigations end in a filing. It doesn't indicate whether you're investigating the right cases.
Bank of America's internal testing found that customers scoring 16 to 19 points (just under the 20-point investigation threshold) warranted SARs 38% to 45% of the time. Meanwhile, customers scoring 20 to 24 points had SAR yields of about 33% to 34%. The customers the system didn't investigate were more suspicious than many it did investigate.
If you tune to increase SAR yield, you're likely cutting borderline cases that should be investigated. You'll file fewer SARs, and examiners will ask why.
Weight Alerts by Risk, Not by Convenience
Bank of America's system gave large cash deposits at ATMs a SAR yield of 56.75%, meaning more than half of customers flagged for this activity ended up in a SAR. Despite this strong correlation with suspicious activity, the alert was worth only one point, and it could contribute only one point total no matter how many times it fired.
Review your alert weights. If high-yield alert types carry low point values, or if they're capped at contributing only once, you're not scoring by risk.
Test Against the Threshold, Not Just Above It
Bank of America's 2022 testing found no statistically significant difference in SAR yield between customers scoring 15 to 19 points and those scoring 20 or more. The threshold wasn't separating suspicious from non-suspicious activity; it was just separating investigated from uninvestigated.
When you validate your scoring model, sample customers on both sides of your threshold. If the customers just below it look as suspicious as those just above it, your threshold is arbitrary.
Don't Document a Tolerance for Missed Activity
Bank of America set a 5% tolerance for missed suspicious activity in late 2023. Regulators will ask what basis you used to decide 5% is acceptable. There's no good answer to that question because the Bank Secrecy Act doesn't authorize you to miss 5% of reportable activity for operational efficiency.
If your system misses activity, document the gap and remediate it. Don't codify an acceptable miss rate.
Staff to the Risk, Not to the Budget
In 2010, Bank of America built Event Processor partly because "there were not enough investigators to work all of the alerts" its monitoring rules generated. When the bank re-tuned the system in late 2023 under regulatory pressure, it estimated it would need an incremental 750 employees to keep up.
If your alert volume exceeds your investigator capacity, the correct response is to hire more investigators or reassess your institution's risk appetite, not to tune the system to generate fewer alerts.
Common Pitfalls
Treating compliance warnings as budget lobbying: Bank of America's internal tests repeatedly showed problems with Event Processor's thresholds. Management could have interpreted these findings as compliance staff lobbying for more resources. That's not an excuse for ignoring the data.
Cutting alerts to cut headcount: From 2018 to 2023, about 80% of Bank of America's scoring changes reduced the points an alert generated. If your recalibration history shows a pattern of cuts, examiners will question whether you're tuning for coverage or for cost.
Expiring points too quickly: Bank of America's original system expired points after 13 months; the revised system shortened that window to four months. Shorter windows mean repeat activity is less likely to accumulate into an investigation. If your expiration period is shrinking, make sure you're not just reducing case volume.
Focusing on conversion rates: TD Bank's 2024 enforcement action faulted the bank for tuning that "focused on SAR conversion rates." U.S. Bank's 2018 action cited caps on alerts "because those fixed caps permitted the bank to hire fewer employees and investigators." The pattern is clear: Fincen does not accept efficiency as a rationale for reducing detection.
Quick Reference Table
| System Design Choice | Risk Signal | What to Check |
|---|---|---|
| High-yield alerts carry low point values | System isn't scoring by risk | Compare SAR yield by alert type to point weights |
| Majority of scoring changes reduce points | Tuning for cost, not coverage | Review recalibration history for directional pattern |
| Points expire in under six months | Repeat activity won't accumulate | Test whether known suspicious patterns reach threshold before expiration |
| Investigation threshold hasn't changed despite testing showing problems | Management prioritizing resourcing over remediation | Review validation reports and remediation timelines |
| SAR yield is a primary tuning objective | Optimizing for efficiency, not detection | Check whether tuning documentation mentions investigator capacity or budget |
| Alert caps are set to match current staffing | Staffing to the system, not to the risk | Compare alert caps to risk assessment and historical suspicious activity volume |
| Documented tolerance for missed activity | Codifying acceptance of compliance gaps | Remove any stated acceptable miss rate; remediate gaps instead |
The ethical and operational pitfalls of prioritizing cost savings over compliance in transaction monitoring systems are clear. Your next step is to review your system's design choices against these guidelines and make necessary adjustments to ensure compliance and effective risk management.
