Bank of America penalized for AML and sanctions failures…
Bank of America faces about $1.21 billion in penalties: a $750M OCC penalty, an additional $450M payable under FinCEN $1.2B assessment after crediting the OCC payment, plus an approximately $11.6M OFAC settlement.
Photo: wirestock na Magnific
FinCEN found that the Bank failed to timely report more than $5B in suspicious transactions, including over $1B connected with national security and priority illicit-finance risks such as Chinese Money Laundering Networks, fraud and potential trade-based money laundering.
Its transaction-monitoring system had serious design and calibration problems. Internal testing identified weaknesses, but meaningful remediation was delayed. FinCEN explicitly states that management focused on the resourcing impact of remediation. When an internal test produced an unfavourable result, the then Global Head of Financial Crimes directed that the test be repeated, producing a more favourable outcome. Compliance teams also recommended offboarding certain high-risk, high-value customers. The Bank retained them, with FinCEN concluding that revenue considerations were prioritised while corresponding monitoring and customer-risk controls were not adequately strengthened.
You can have:
Compliance
RiskManagement
InternalAudit
transaction monitoring
policies, committees and escalation paths
…and still fail badly when incentives at senior-management level point in a different direction.
Controls are only as strong as the governance environment in which they operate.
If senior management wants a control weakened, delayed, circumvented or not treated as a priority, there are usually many ways to achieve that without formally saying: “ignore the control”.
Interestingly, FinCEN estimated that fixing the monitoring model would require around 750 additional employees. The regulator concluded that the Bank had likely saved hundreds of millions of dollars in compliance expenditures while deficiencies remained unresolved.
OFAC separately identified 475 apparent sanctions violations involving programmes related to Russia, Belarus, Iran and other sanctions regimes. The causes included technical failures, human errors and weaknesses in sanctions screening. Really?
The penalties, however, are largely paid by the institution, meaning ultimately shareholders absorb much of the cost. Whether that creates sufficient personal accountability to prevent similar behaviour in the future is another question entirely.
Will Bank of America make it onto my presentation’s corporate “wall of shame”?
Probably. The list is already getting rather long.
Author: Sebastian Burgemejster
Comments