Your Alert Thresholds Need Evidence, Not Stakeholder Judgment

On October 13, 2026, FinCEN assessed a $1.2 billion civil money penalty (opens in a new tab) against Bank of America, N.A. The OCC imposed $750 million (opens in a new tab) the same day, and FinCEN credits that amount against its own penalty. The bank admitted that it willfully violated the Bank Secrecy Act, including by failing to file SARs.

It’s easy to read this as a megabank story. The bank ran its own proprietary monitoring system, and the order describes more than $5 billion in missed or late-reported suspicious activity. A BSA Officer at a $2 billion bank could skim the headlines and move on.

That would waste the most useful enforcement document of the year. Most of the consent order (opens in a new tab) explains how the bank set, tested, and changed its alert thresholds. Every bank running a vendor system makes the same decisions. The order shows the evidence FinCEN expects behind them, and it landed six months after the agencies narrowed model risk guidance to mostly larger banks. It’s written for BSA Officers and CCOs at banks, credit unions, and sponsor banks.

What did FinCEN find behind the thresholds?

The bank’s system scored activity and opened a case for investigation at 20 points. FinCEN says that threshold was “initially set by stakeholder judgment” and stayed in place until December 2023. It was “not adequately supported by documentation or empirical evidence.”

The scoring weights barely moved. From 2018 to 2023, 76% of risk factor weights stayed the same, and about 80% of the changes that were made lowered a weight. Many cash-related risk factors carried a single point despite SAR yields above 50%.

The bank’s own testing showed the problem. In 2022 and early 2023, activity scoring just under the threshold produced SAR yields of 38% to 45%. That beat the roughly 33% to 34% yield the bank had found at or just above the threshold in its 2018 to 2020 testing. The bank lowered the threshold only after extensive engagement with its regulators.

Two more findings apply at any size. Rules that “rescored” or suppressed activity were developed in an “ad-hoc and subjective fashion,” and about 150,000 event groups had triggered that logic when the bank turned it off. For several years, more than one-third of investigations started from law enforcement referrals, 314 requests, subpoenas, and manual referrals rather than the system’s own alerts.

The testing asked the wrong question

FinCEN aims as much criticism at the testing as at the system. The bank’s threshold tests asked whether SAR yields above and below the line were statistically different. They didn’t ask how much suspicious activity sat below the line, or whether that amount was growing.

The bank also had no objective benchmark, such as a false negative tolerance, to judge results against. When it finally set one at 5%, the activity just below the old threshold was producing SARs at seven to nine times that rate.

The order adds a note on metrics. Institutions “may find it useful to measure SAR yield in evaluating the effectiveness of their internal controls, but this is not the only metric that can be considered.” Pick metrics that fit your risk profile, then act on what they show.

Independent testing drew the same criticism. FinCEN says internal reports on the system “failed to meaningfully address such apparent issues.” The OCC separately found that the bank’s BSA audit function missed long-standing problems that examiners later identified.

Why the model risk rewrite doesn’t change this

On April 17, 2026, the Federal Reserve, FDIC, and OCC issued revised guidance on model risk management (opens in a new tab). It supersedes (opens in a new tab) the 2021 interagency statement on model risk for BSA/AML systems. The agencies expect it to be “most relevant to banking organizations with over $30 billion in total assets.” The new definition of a model also excludes “deterministic rule-based processes.”

Many community bank monitoring systems run rules-based scenarios with fixed thresholds. Under the new guidance, those may not be models at all, at banks the guidance mostly doesn’t reach. It’s tempting to read that as the end of validation-style work on monitoring.

That reading misses where the obligation comes from. The guidance says it sets no enforceable standards, and that supervisory action may still follow violations of law. FinCEN’s case rests on the BSA’s internal controls requirement and the SAR rule, not on model guidance. The OCC cited 12 CFR 21.21 and 21.11. A threshold with no documented rationale is an internal controls question, whatever the guidance calls it.

Timing is part of the same question. A bank must file a SAR no later than 30 calendar days (opens in a new tab) after initial detection, or 60 if no suspect is identified. Bank of America’s system aggregated activity over long periods, and the bank filed a material portion of its SARs more than six months after the activity. The clock starts at detection, so slow detection produces stale SARs that still meet the deadline.

What to do now

1. Write down why each threshold sits where it does. For every scenario, record the threshold, the data or reasoning behind it, when it last changed, and who approved it. A vendor default is a starting point, not a rationale, and each threshold should trace to the risks rated in your BSA/AML and sanctions risk assessment workbook. The BSA Officer owns this, and the evidence is a threshold rationale file the BSA committee has reviewed and noted in its minutes.
2. Test below the line against a tolerance you set first. Sample activity just under each threshold, investigate it, and compare the results with a missed-activity tolerance written down before the test. Track how many cases start from subpoenas, 314(a) matches, and referrals instead of alerts. The BSA Officer owns the testing, and the evidence is the workpapers plus a tuning log showing what changed because of them. A transaction testing workpaper gives each test a documented sample, results, and conclusion.
3. Put suppression rules and test scope under governance. Inventory every suppression list, exclusion, and scoring override, with an owner and a review date, and have the committee approve additions. Make sure the independent test covers whether thresholds catch suspicious activity, not only whether the system ran. The CCO owns the governance, and the evidence is the approved inventory and a test report that addresses threshold effectiveness.

None of this needs a data science team. A community bank can do it with a spreadsheet, a sample of below-the-line activity, and a committee willing to ask why a number is what it is. That work is far easier to build before an exam than to reconstruct during one.

A threshold nobody can explain is a decision nobody made.

Sources

• Consent Order Imposing Civil Money Penalty, In the Matter of Bank of America, N.A., No. 2026-03 | FinCEN (Oct. 13, 2026) (opens in a new tab)
• FinCEN Assesses $1.2 Billion Penalty against Bank of America | FinCEN (Oct. 13, 2026) (opens in a new tab)
• OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance, NR 2026-89 | OCC (Oct. 13, 2026) (opens in a new tab)
• Supervisory Guidance on Model Risk Management | Federal Reserve, FDIC, OCC (Apr. 17, 2026) (opens in a new tab)
• SR 26-2, Revised Guidance on Model Risk Management | Federal Reserve (Apr. 17, 2026) (opens in a new tab)
• 31 CFR 1020.320, Reports by banks of suspicious transactions | eCFR (current) (opens in a new tab)