Coverage Gaps in Transaction Monitoring: FinCEN's Consent Order of October 2024

On October 10, 2024, FinCEN, the Financial Crimes Enforcement Network of the US Treasury, published a consent order imposing a civil money penalty on two US banks, which the order calls collectively "the Bank", for violations of the Bank Secrecy Act. The bank, the order says, "admits only to the facts admitted in the October 10, 2024 plea agreements" with the US Department of Justice, and "neither admits nor denies the remainder of the facts set forth herein". The parts of the order that follow concern the bank's transaction monitoring system. They are not the whole.

The System's Coverage

When the system was first implemented in 2008, the order says, the bank applied certain scenarios provided by its vendor without considering whether they needed to be tailored to its products and services, or whether they were sufficient for the specific risks it faced. In the end, the system's coverage "excluded large swaths of the Bank's transactions". In 2023 alone, the order says, the coverage gaps applied to several trillion dollars of transactions that the system did not screen.

Among the transaction types the bank failed to monitor, the order lists ACH transactions, certain funds transfers and certain monetary instruments. ACH, or Automated Clearing House, transactions are, in the order's account, transfers of funds up to $1 million that use the ACH network to move money from one bank or credit union in the United States to another financial institution. They can be sent outside the United States, but the bulk are domestic, and they range from automatic bill payments and payroll and benefit deposits to, more recently, certain peer-to-peer payment applications. The bank's monitoring system, the order says, lacked the transaction codes necessary to monitor 98% of domestic ACH transactions.

Domestic Transaction Monitoring

Since at least 2012, the order says, the bank knew it failed to monitor virtually any domestic ACH transactions. A 2017 internal coverage assessment reported "no active ACH monitoring" was in place for domestic ACH transactions. The review and approval of these annual coverage assessments was delegated by the bank's BSA Officer to subordinates.

"Subsequent coverage assessments incorrectly reported that the transaction monitoring system covered ACH payments," the order says, "even though such coverage was limited to international ACH transactions only (a small portion of the total population of ACH transactions)." That inaccurate reporting continued, it says, "for the remainder of the Relevant Time Period because the Bank never conducted any mapping or testing to verify which types of transactions were covered by the transaction monitoring system." Its failure to conduct appropriate testing and gap assessments of the system "led these monitoring gaps to persist for well over a decade."

Scenarios and Testing

The order says the governance of the system "also proved ineffective," as leadership allowed temporarily paused scenarios to remain dormant for years and failed to implement new scenarios even after identifying risks. In 2011, AML senior management "paused" a scenario targeting large cash deposits in commercial accounts. The pause was framed as temporary at the time, but the scenario "remained dormant for at least a decade." As a result, the order says, the system failed to generate over 150 alerts for suspicious activity related to a scheme involving one group of the bank's customers.

The bank, the order adds, "did not effectively test its transaction monitoring system to ensure that it captured the Bank's risks comprehensively."