The OCC Says a National Bank Failed for Years to Ensure It Had an Appropriate Transaction Monitoring System

The Office of the Comptroller of the Currency issued a consent order, signed for the Comptroller on October 13, 2026, against a national bank that it charters and examines. The order concerns deficiencies in the bank's Bank Secrecy Act and anti-money laundering compliance program, which "resulted in violations of law or regulation," and it orders a civil money penalty. The bank consented to it "in the interest of cooperation and to avoid additional costs associated with administrative and judicial proceedings." Under the heading "Comptroller's Findings," the order says, "The Comptroller finds, and the Bank neither admits nor denies, the following."

The order names the bank. This article does not. Parts of the order follow, not the whole.

A Monitoring System That Missed

"For years, the Bank failed to ensure it had an appropriate transaction monitoring system," the order says, including its suspicious activity detection models, which it calls "feeder" models, and "the risk scores that Event Processor, the Bank's system for evaluating alerted transactions, assigned to those transactions, and the timelines and thresholds for determining when transaction alerts should trigger a case investigation." Together, it says, these failures resulted in the bank "missing and late-filing" a large number of SARs, its suspicious activity reports.

"Since at least 2019, the Bank failed to properly monitor trillions of dollars of transactions, resulting in a large number of missed, late, inaccurate, and incomplete SAR filings involving billions of dollars in suspicious activities," the order says. It also failed "to monitor hundreds of thousands of customer transactions through its suspicious activity monitoring processes."

Between 2019 and 2023, the order says, bank management, including the then-BSA Officer, received written reports showing that the bank was failing to file suspicious activity reports "on approximately 18%-44% of potentially suspicious activities not referred for investigation (depending on the year)."

Who Found the Gaps, and Who Did Not

More recently, the order says, examiners identified a "systemic gap" in the bank's monitoring of credit cards, "which prevented the Bank from timely identifying and reporting certain types of suspicious activity." As an example, it says, examiners reviewed a small sample of customer accounts and identified ten with potential trade-based money laundering. At the regulator's request the bank reviewed them, and filed reports "on hundreds of millions of dollars in suspicious transactions that occurred in half of these accounts." The order adds: "Absent the OCC's request, which prompted the Bank's review, there is no indication that the Bank would have reviewed these accounts or filed these SARs."

"While OCC examiners identified significant deficiencies in the Bank's BSA program, the Bank's BSA Officer and the Bank's independent testing, managed by Corporate Audit, failed to identify these significant deficiencies," the order says.

A monitoring system can run every day and still miss what it was built to catch. In this order the bank's own independent testing missed the program's deficiencies too, and a small sample in an examiner's hands found a gap.

For many years, the order says, the bank sent wires with inaccurate transmittor name information in outgoing wire transfers. "In April 2024, the Bank self-identified this issue, though it does not know how long it had been sending inaccurate wire information before it stopped the practice in 2024."

The Order

As of the date of the order, the findings say, "the Bank's BSA/AML program remains deficient. Critically, the Bank continues to have internal control gaps." The bank "has not made sufficient progress in addressing its multiple internal control weaknesses" since an earlier cease-and-desist order, to which it consented on December 23, 2024, and has begun to implement "some of the many significant changes needed to establish an effective and compliant BSA/AML program."

The bank shall pay a civil money penalty of $750 million, upon the execution of the order. The order is a settlement of the civil money penalty proceedings based on the violations its findings describe, and it releases the bank from potential liability for a civil money penalty based on them, "to the extent known to the OCC as of the effective date of this Order." The regulator reserves its right to assess additional civil money penalties or take other enforcement actions "if the OCC determines that the Bank has continued, or failed to correct, the violations described in Article II of this Order." Nothing in the order, it says, affects actions "that may be or have been brought by any other representative of the United States or an agency thereof," the Department of Justice among them.

Which of a firm's monitoring systems would show it, if the thresholds that send an alert to an investigation were set wrong?