Bank of America's Merrill Lynch Pays $7.5 Million Fine for Anti-Money Laundering Reporting Failures
N.R. Finch
Merrill Lynch agreed to pay the SEC a $7.5 million penalty for failing to file suspicious-activity reports over four years — the third settlement between the two sides on the same issue, as regulators treat systemic compliance gaps as ongoing violations.
What exactly did Merrill fail to report?
The SEC alleged that from April 2020 to September 2024, Merrill's monitoring software — called the "event processor" — only flagged transactions scoring ≥ 20 on its risk scale. Everything below that threshold was automatically skipped.
This means → the system treated an arbitrary score cutoff as a safety line, leaving suspicious trades below it entirely unreviewed.
Regulators determined that some of the ignored transactions should have triggered SAR filings — suspicious-activity reports required under the Bank Secrecy Act — involving amounts totaling hundreds of millions of dollars.
They knew about the gap — why wait until late 2023 to fix it?
The SEC noted in its order that Merrill and Bank of America had repeatedly spot-checked transactions below the threshold and found many that did warrant further review.
In plain terms = they ran the checks, saw the blind spot, yet did not lower the trigger threshold until December 2023.
That window of "knew but didn't act" is the core of why the SEC treated this as a serious violation, not a routine oversight.
Is a $7.5 million fine actually significant?
For a firm of Bank of America's scale, $7.5 million is not a material financial burden. Merrill neither admitted nor denied wrongdoing.
The SEC made clear, however, that it credited Merrill's remedial steps in setting the penalty — including lowering the threshold and running a retrospective review of past transactions, which led to a "significant number" of back-filed SARs.
This means → without those remedial actions, the fine would likely have been higher. Cooperation bought leniency.
A third settlement — what signal is the regulator sending?
This is the third SEC settlement with Merrill over anti-money-laundering reporting, following earlier ones in 2017 and 2023.
This reflects the regulator's position: systemic compliance failures are not one-time mistakes but ongoing violations — and repeated lapses on the same issue will draw progressively harsher treatment.
Put simply = if your compliance system has a known blind spot and you don't fix it promptly, regulators will not wait for a scandal to act.
Content is for reference only, not financial advice.