Below Twenty: The Alert Threshold Bank of America Would Not Move

On 13 October 2026, the US Treasury announced penalties of more than $1.21 billion against Bank of America, including the third-largest penalty in its history. The Financial Crimes Enforcement Network (FinCEN) imposed $1.2 billion of that, crediting a record $750 million paid to the Office of the Comptroller of the Currency (OCC). The bank admitted wilfully violating the Bank Secrecy Act. Yet the most revealing number in FinCEN's consent order is not a dollar amount. It is 20.

Twenty was the risk score a cluster of alerts had to reach before anyone at the second-largest bank in the US would investigate it. In the bank's own words, quoted by FinCEN, the line was "initially set by stakeholder judgment". Its testing showed for years that the line sat too high. It stayed put anyway.

The case is easily read as a story about scale and wilfulness. It is better read as a story about calibration. It reveals what happens when the capacity of an investigations team quietly becomes the risk appetite of an institution.

Calibration is a risk decision

Every monitoring system draws a line between activity that is examined and activity that is not. That line is meant to express risk. The Financial Conduct Authority (FCA) made the point in the good practice on automated transaction monitoring carried in its Financial Crime Thematic Reviews. Firms should not set systems to generate fewer alerts simply to improve performance statistics. Where resource is mentioned, it points the other way: firms should allocate adequate resources to analysing and assessing system performance.

Washington's reform agenda sharpens that distinction. FinCEN presented its proposed rule of 7 April 2026 as one that "empowers financial institutions to devote more attention and resources toward higher risks rather than toward lower risks". The proposal itself disclaims "regulatory second-guessing of a financial institution's reasonable determinations". Yet it also cites internal controls left unperformed, because the required resources have become inadequate, as a sign that a programme is not implemented in all material respects.

Prioritisation by risk is being encouraged. Suppression by capacity is not. The Bank of America order shows exactly where one ends and the other begins.

The evidence sat below the line

The consent order describes a control designed to ration attention. FinCEN calls the Event Processor the primary control the bank used to identify and report suspicious activity. It gathered a customer's alerts into 'Event Groups' and combined their risk scores. A group was not investigated unless it reached 20 points within 13 months of its oldest active alert.

The warnings were specific. A testing report found that groups scoring 14 to 19 points had the highest suspicious activity report (SAR) yield of any band, a trend it said had been rising since 2016. Testing in 2022 and the first quarter of 2023 put the SAR yield for groups scoring 16 to 19 points at between 38 and 45 per cent. Groups at or just above the line had yielded 33 to 34 per cent in testing from 2018 to 2020.

In other words, the activity left below the line had become more likely to prove suspicious than activity the bank had previously judged worth investigating. A 2022 model validation said the threshold "needs to be justified". Until near the end of the relevant period, the bank had no predefined tolerance for false negatives at all.

Asked in 2022 to justify its modelling choices, the bank tested an unconstrained threshold. The test found it would uncover more SARs: 85.4 per cent against 20.2 per cent on below-the-line samples. The bank rejected it, citing the "practical concern of pushing too many below-the-line event groups to cases". Given the enormous below-the-line population, it said, the low SAR yield "may exhaust the investigation resources" and crowd out the most urgent cases. FinCEN notes that the yield the bank called low was roughly three to five times the benchmark it later adopted.

Rather than change the threshold, the bank sought to justify it, "including by citing to the impact that would have on Bank resources". It framed the choice as prioritisation. FinCEN's findings describe a primary control that was not reasonably designed.

Capacity held the line

FinCEN is explicit about the motive. The bank's failure to reasonably remediate identified deficiencies, it found, "stemmed in part from its failure to devote adequate resources to case investigations". The numbers explain why.

The bank lowered the threshold to 10 or 12 points in December 2023. It estimated that the change would add 16,000 US investigations a month, "double [the] prior ongoing monthly volume". It would need an "incremental 750" personnel to keep pace, plus 800 consultants for a one-off lookback. That lookback found nearly 8,900 SARs the bank had failed to identify and file, on transactions worth nearly $4 billion.

Those figures mark the gap between the investigations function the bank had and the one its risks demanded. A threshold held for capacity reasons hides that gap. Alerts that never become cases leave no queue to lengthen and no backlog to report. The shortfall never reaches the usual operational metrics.

Treasury's summary is blunt: the bank "prioritized its revenues and minimized the impact on its required compliance resources". FinCEN concluded from the bank's own staffing estimate that it had likely saved hundreds of millions of dollars in compliance costs. It gave that financial gain greater weight in setting the penalty.

A formal order did not resolve the escalation problem either. The OCC found that more than a year after its December 2024 cease-and-desist order, the bank "still failed to escalate potentially suspicious activities to investigators for review". Comptroller Jonathan V. Gould called the violations "egregious and continued". A threshold held in place by headcount is not a model parameter. It is a staffing decision wearing a risk label.

Detection was outsourced

A throttled control does not leave a firm blind. It leaves the firm leaning on whoever else is looking. For several years, more than a third of the bank's suspicious activity investigations were prompted by 'promotion' events, not by its own automated controls. These events carried human intelligence: law enforcement referrals, grand jury subpoenas, information-sharing requests and employee referrals. In 2023, they drove nearly half of the cases its Event Groups generated.

Treasury described a "reliance on law enforcement inquiries, requests by other financial institutions" through which the bank "effectively outsourced to third parties" a substantial part of its detection duties. That reliance flatters the metrics. Cases prompted by a subpoena arrive with suspicion already attached, so a programme that leans on them can post respectable conversion rates while its own detection decays. The FCA's good practice warns of a related distortion in tuning: 'artificially' raising the proportion of alerts reported as suspicious without improving the quality and quantity of the alerts being generated.

Suppression also ran inside the engine. Rescoring logic automatically cut some risk factors to zero; around 150,000 active Event Groups had triggered it by the time it was switched off in December 2023. A feature built in January 2024 to flag trade-based money laundering was used only on activity already under investigation and, during the relevant period, never to generate alerts. When outside inquiries become a primary trigger for investigation, the reporting relationship the Bank Secrecy Act was built on runs in reverse.

The UK has seen this before

UK firms may be tempted to treat this as an American problem of scale. But the FCA's enforcement record says otherwise. Its December 2022 Final Notice against Santander UK, which carried a £107.8 million penalty, recorded that the bank had exempted all medium and low-risk customers in its retail and business banking division from periodic review. An internal document described the risk assessment of its existing customer base as "de scoped due to the costs involved".

The FCA observed that the exemption "appears to have been driven by the fact that Santander UK did not have the resources" to carry out the reviews. The same notice records a backlog of 6,464 medium-risk alerts in December 2012. The oldest was 161 days old.

The challenger bank cases come at the same problem from the other side. The FCA's penalties against Starling Bank in October 2024, of almost £29 million, and Monzo in July 2025, of £21.1 million, both turned on financial crime controls that did not keep pace with growth. Starling's customers rose from around 43,000 in 2017 to 3.6 million in 2023. Monzo's grew from about 600,000 in 2018 to more than 5.8 million in 2022.

The symptoms differ. The arithmetic does not. When risk outgrows the capacity to examine it, and the gap is absorbed rather than escalated, the excess simply goes unseen.

Thresholds need an owner

The implication is clear. Alerting and investigative capacity must be aligned, but the alignment runs one way only. Capacity should rise to meet the risk; the line should never be held at whatever level capacity can absorb.

In practice, that starts with evidence. Every threshold needs a rationale tied to the firm's risk assessment, a named owner and a record of the testing behind it. Below-the-line testing should run on a fixed cycle, against a false negative tolerance agreed before the results arrive. Where yields beneath a line match or beat those above it, the finding belongs in front of the board as a resourcing question. It does not belong in a working paper that protects the status quo.

Calibration and capacity planning are separate conversations, and Bank of America let them merge. Calibration should answer what the firm needs to see; capacity planning should answer what it will cost to see it. When the second begins to shape the first, the board should know. In the UK, the money laundering reporting officer holding Senior Management Function 17 should be able to tell the FCA why each line sits where it does.

Firms should also track how much of their investigative work begins outside their own systems. A rising share of cases opened in response to production orders, law enforcement requests or correspondent enquiries is not a sign of a responsive programme. It is an index of how much the firm's own detection is missing.

The US reform agenda does not lower the evidential bar. It raises it. FinCEN's proposal says examiners should not substitute their own subjective judgement for a firm's. Yet they will still assess whether its resource allocation decisions are informed by reasonably designed risk assessment processes. Freedom to de-prioritise lower risks depends on showing why they are lower. A threshold whose real justification is headcount will not survive that question.

Conclusion: Headcount is not a risk appetite

Every monitoring system needs a threshold, and every investigations team has a limit. Bank of America's failure was letting the second keep the first in place, for years, against the warnings of its own data. Suspicious activity accumulated below twenty while the line stayed where it was. A threshold that evidence cannot move has stopped measuring risk. Regulators have now made clear that they will measure it instead, and charge for the difference.

Does your alert threshold reflect the risks your firm runs, or the size of your investigations team?

If you cannot say with confidence which, we can help you find out before your regulator does, so contact us.

At OpusDatum, we examine whether the governance behind monitoring calibration would withstand regulatory scrutiny: who set each threshold, what evidence supports it and how capacity pressures reach the board. Our focus is the defensibility of those decisions before a regulator, a lookback or a consent order tests them.