The OCC Says a Federal Savings Association's Automated Alert Triage System Auto-Closed Alerts That Should Have Been Escalated for Further Review

The Office of the Comptroller of the Currency, the OCC, supervises the bank in this case, a federal savings association. Its consent order, number AA-ENF-2025-21, was signed for the Comptroller on April 24, 2026. The OCC, it says, intended to begin cease and desist proceedings for deficiencies in the bank's Bank Secrecy Act and anti-money laundering compliance program "which resulted in violations of law or regulation," and the bank, through its board, consented to the order, in the interest of cooperation and to avoid additional costs. The findings are the Comptroller's, and "the Bank neither admits nor denies" them. Parts of the order follow, not the whole.

The Comptroller's Findings

Since 2020, the order finds, the bank has significantly grown its payment processing line, relative to its size, resulting in significant annual wire and ACH activity, including cross-border activity involving foreign financial institutions. Despite that growing volume and the attendant risks, it says, the bank "has failed to develop and maintain controls and risk management processes commensurate with its risk and growth."

The order adds that its findings are based on examination of the bank's compliance program as a whole, and on concerns "largely unrelated to customers involved in digital assets activities."

The bank's suspicious activity monitoring processes, the order says, are deficient for identifying, investigating and reporting potentially suspicious activity. The filtering criteria and thresholds of its automated alerting system "had not been adequately tuned to the risk profile of the Bank's payment processing line, the significant increases in higher risk products and services, and international exposures."

The order finds that the bank "utilized an automated alert triage system, but several deficiencies in its logic, data, and methodology resulted in the system auto-closing alerts that should have been escalated for further review." And: "As a result, the system auto-closed a very high percentage of all ingested alerts."

It finds the bank's independent testing weak as well, and gives as an example that "the Bank's internal auditor failed to identify BSA/AML program weaknesses."

What the Order Requires

The bank must develop, implement and adhere to a risk-based program for identifying, evaluating and reporting suspicious activity. That program must ensure the bank "has monitoring systems that effectively identify potentially suspicious activity," including by applying appropriate rules, thresholds and filters, with "effective controls, as appropriate, to ensure the Suspicious Activity Report Program is functioning as intended," including when the bank establishes a new product or service or enters a new line of business. It must also ensure, among other things, that the bank dispositions alerts effectively and on time, and files its suspicious activity reports timely, completely and accurately.

The order also requires a look-back. An independent, third-party consultant, subject to the OCC's prior written determination of no supervisory objection, is to review and report on the bank's suspicious activity monitoring, investigation, decisioning and reporting, and the look-back "shall determine whether SARs should be filed for any previously unreported suspicious activity and to review the quality and accuracy of previous SAR filings to determine whether corrections or amendments are necessary."