Bank of America’s October 2026 FinCEN consent order raises a question that deserves attention wherever institutions develop their own compliance technology systems: how readily will management reconsider a design that its own people created and have defended for years? That question becomes more difficult when reconsideration means hiring more investigators, acknowledging weaknesses in previous decisions, or changing how valuable customers are managed.

In the case of Bank of America’s recent woes, the findings extend well beyond Event Processor, the bank’s proprietary transaction monitoring system. Customer reviews omitted material activity, and correspondent account diligence relied on an insufficient understanding of foreign branches and affiliated institutions. More than $5 billion in suspicious transactions went unreported or were reported late. Reading these findings together, I see a recurring problem with the assumptions the bank accepted—and with how much evidence it took to disturb them.

For me, the order brings together two problems that deserve more attention across the industry: the difficulty of sustaining independent skepticism around something an institution has built itself, and the tendency to confuse performing compliance activities with managing compliance risk.

The problem with “we can build it ourselves”

There are good reasons to develop a system internally. An institution may understand its operations better than a vendor does, and its needs may justify a tailored solution. And vendors can sometimes be solely focused on the software sale with no regard to whether the software addresses client needs, whether it is effectively integrated into client control mechanisms, or whether updates are necessary to effectively and timely address client risks. So, I have no objection to that decision when it rests on a realistic assessment of requirements, capabilities, and ongoing responsibilities.

My concern is what sometimes happens afterward. The system becomes associated with the people who conceived it, the executives who approved it, and the institution’s view of its own sophistication. Questioning its effectiveness starts to feel like questioning all three. Over time, “we can do it better” can become an expectation that others accept the system’s credibility. In other words, implementation of a “home grown” system does not negate the need for effective governance. I would argue it increases the need.

The order does not say Bank of America prohibited criticism of Event Processor. Employees produced testing that identified significant weaknesses. What it documents is an inadequate response to evidence that should have prompted meaningful change. Having people who can raise questions is only part of independence. Their conclusions must carry enough weight to affect decisions.

In the consent order, FinCEN described how EP generally required accumulated alerts to reach a score of 20 before an investigator reviewed them. FinCEN noted that threshold was initially based on stakeholder judgment and remained in place until December 2023. Meanwhile, testing identified substantial suspicious activity reporting yields below the threshold. In some periods, those yields exceeded levels previously observed among groups considered worthy of investigation. At that point, management needed to demonstrate why continuing to use the threshold was reasonable. Instead, the order describes efforts to justify the existing approach, including concerns about the investigative workload a change would create.

FinCEN also describes a 2023 instance in which the former Global Head of Financial Crimes directed that a test be repeated following an unfavorable result. The second test disputed the earlier findings and supported retaining the threshold. There can be legitimate reasons to repeat a test. When a result threatens an established operating model, however, the independence of that decision requires particular scrutiny.

I would expect a sound governance framework to ensure truly independent assessment and promote a legitimate level of skepticism around any system or process, regardless of who developed or manages it. I would expect disagreement, such as in the case of the 2023 testing instance, to be visible. Who believed the original findings were wrong, and on what evidence? Who independently assessed the competing conclusions? What happened to potentially suspicious activity while the disagreement remained unresolved? A validation report provides limited assurance if management acknowledges findings without addressing their consequences. An unwillingness to question the system becomes particularly concerning when testing repeatedly shows that it is missing suspicious activity.

The customer was valuable. The risk still needs to be managed.

The customer due diligence findings make the commercial pressures especially clear.

Compliance personnel identified concerns involving online auto auction customers: third-party payments, limited source-of-funds transparency, fraud-related activity, substantial negotiable instrument deposits, and exposure to higher-risk jurisdictions. Compliance recommended closing the accounts for one customer, but the relationship team emphasized the customer’s importance, approximately $6 million in annual revenue, and the broader lending and treasury relationship. Compliance personnel had anticipated resistance because the relationship was longstanding and involved significant credit exposure. In fact, that focus on the relationship won the day and the customer remained a customer despite the compliance risks.

None of that is surprising. Relationship managers are expected to understand and advocate for their customers. Their knowledge should inform the decision. But revenue and credit exposure do not explain how financial crime risk will be controlled.

If the institution retains a relationship over compliance concerns, someone must be accountable for explaining why the safeguards are sufficient and demonstrating their implementation. The business cannot receive the benefit of the doubt simply because the customer matters commercially. Nor should compliance’s participation in a meeting establish that its concerns have been resolved.

FinCEN concluded that the bank prioritized revenue associated with certain relationships while accepting continued activity of concern without corresponding changes to customer profiles or ongoing monitoring. This goes beyond a difference of opinion about a customer. The bank knew what concerned its compliance personnel, retained the relationships, and failed to make commensurate changes to how it managed them.

Closure does not necessarily have to be the answer. FinCEN makes that point in the order, and it matters. Restrictions, enhanced monitoring, or other measures may allow an institution to retain a customer. If third-party payments are central to the concern and those payments continue, management must evaluate that exposure and verify the effectiveness of alternative safeguards.

Customer assurances and mitigation proposals are a starting point for that work. They cannot establish its completion.

What did the customer reviews accomplish?

The bank had customer risk ratings and quarterly activity reviews. Reading the findings, I kept returning to the gap between those processes and the information they should have captured.

For one customer, a quarterly review failed to discuss approximately $1.1 billion in wires from a UAE affiliate, an increase exceeding 200 percent over the comparable prior-year period. Other reviews omitted negotiable instrument activity even where customers deposited tens of billions of dollars in those instruments. Some observations carried forward between reviews without adequately addressing relevant changes.

A review that misses activity central to a customer’s exposure provides little assurance that the institution understands the relationship. Raising a risk rating is similarly unhelpful if it does not change the diligence performed or monitoring applied.

Customer due diligence should establish a useful baseline: how the customer operates, who pays it, where funds originate, and what activity makes sense for the relationship. Monitoring should test actual behavior against that understanding. Investigations should then feed what they uncover back into the profile, including information about connected customers and counterparties.

The same information should influence the enterprise risk assessment. If investigations reveal a recurring weakness across an industry, product, or payment channel, the institution needs to assess the broader exposure. Those findings should affect monitoring coverage, staffing, testing priorities, and training. Otherwise, separate teams can maintain apparently complete processes while reaching inconsistent conclusions about the same risk.

This is why I am skeptical of programs that place too much emphasis on completion rates. Knowing that scheduled reviews and enterprise risk assessments were completed tells management something about workflow. It says little about whether reviewers identified material changes, understood their significance, and caused anyone to act.

Correspondent due diligence and misplaced familiarity

The correspondent account findings deserve attention of their own. According to the order, until late 2024, Bank of America permitted reduced due diligence for correspondent accounts maintained for its foreign branches and affiliates. FinCEN reviewed twelve entities and found insufficient information about account purpose, anticipated activity, business characteristics, and supervisory regimes. Some files offered general descriptions of activities. Others contained material with little relevance to understanding money laundering risk, including stock-price graphs. Separate assessments and industry questionnaires did not fill the gaps.

The order also noted that the reviewed branches and affiliates maintained accounts for more than 250 nonbank financial institutions, including money services businesses or foreign equivalents. Their associated payments did not fit a generalized description of interbank settlement activity and the bank needed a more specific understanding of the business flowing through those accounts.

Correspondent due diligence needs to explain how an account will be used and test that understanding against actual activity. Relevant jurisdictions, the respondent’s customers, supervisory conditions, and exposure to other financial institutions all matter. A questionnaire can contribute information, but someone must assess whether the answers adequately explain the risk.

Any differentiated treatment requires documented analysis and effective controls. Internal affiliation should make relevant information easier to obtain; it should not reduce the institution’s interest in obtaining it.

There is a connection here to the treatment of an internally developed system. Knowing the organization—or believing that you know it—can discourage questions that still need to be asked. Common ownership does not establish an account’s purpose, expected transactions, or underlying customer exposure.

Risk must determine the work

Across these findings, the danger of a check-the-box approach is evident. Although the bank could point to tests, reviews, ratings, and escalations, those activities did not consistently produce controls that reflected or effectively mitigated the risks.

The resource argument surrounding EP deserves particular scrutiny. Lowering the threshold would increase investigations, and the bank raised that operational consequence when considering an alternative approach. But an increase in work might have indicated that the existing process was leaving too much suspicious activity unexamined. Management needed to resolve that question before relying on workload as a reason to preserve the threshold. Otherwise, a staffing constraint could acquire the appearance of a defensible risk decision.

The bank’s experience also shows why testing must examine the assumptions behind a control. EP testing considered differences in SAR yields above and below the investigation threshold without adequately addressing the significance of suspicious activity being missed. A test could therefore be completed while leaving the central risk question unresolved: was the bank failing to investigate activity that warranted attention?

The correspondent account findings expose a similar problem with the starting assumptions. Reduced diligence for affiliated institutions left the bank without sufficient understanding of how their accounts were used. If a review accepts that reduced treatment without questioning its basis, it can confirm adherence to an inadequate process. Testing needs to reach back far enough to determine whether the process itself makes sense.

Data quality belongs in this discussion because the order identifies a specific consequence. The bank’s systems did not distinguish adequately between types of negotiable instruments, impairing targeted monitoring. Meanwhile, quarterly customer reviews omitted those deposits despite their substantial volume. The automated and manual processes therefore left overlapping gaps. Someone needed to recognize that the institution lacked a reliable view of a material payment activity and determine how it would monitor that exposure until the limitation was corrected.

There was also information the bank possessed but failed to use effectively. Investigations, third-party inquiries, changing geographic activity, and concerns about connected customers did not consistently alter customer profiles or monitoring. Collecting more information would not, by itself, have solved that problem. The institution needed a process that required relevant findings to reach the people responsible for reassessing the relationship—and required those people to act.

That is where accountability becomes concrete. When compliance identified third-party payments as a central concern, the decision to retain the customer should have produced clear requirements for controlling that activity. Management then needed evidence that the measures were implemented and effective. Continuing discussions while substantially the same concerns persisted should have prompted renewed escalation.

The order’s undertakings follow this logic. They require independent reviews extending beyond EP to customer due diligence, foreign correspondent account due diligence, and data governance. They also require assessment of interim monitoring controls and subsequent verification of material improvements. A revised process is not assumed to be effective merely because it has been introduced.

The connection between EP and the affiliated correspondent accounts is worth carrying into management’s own review of the program. An internally built system may benefit from confidence in its designers; an affiliated institution may benefit from confidence on the part of the organization. However, both still require evidence that the controls fit the activity and exposure. Familiarity should help management ask better questions and not serve as a sole risk mitigant.

Commercial considerations make that discipline harder to sustain. A customer’s revenue and a system’s operating costs are readily quantified. The consequences of missed suspicious activity are less immediately visible. That imbalance gives the first line’s arguments considerable force, even before anyone explicitly chooses commercial interests over compliance concerns. Independent challenge must be strong enough to examine the assumptions behind those arguments. A completed review or validation cannot provide that protection if the institution is unwilling to reconsider what it already believes.