The regulatory action centers on the bank’s reliance on automated transaction monitoring software designed to comply with the Bank Secrecy Act. Between April 2020 and September 2024, Merrill Lynch utilized a system that aggregated potential misconduct into event groups assigned specific risk scores. Investigators found that the firm ignored any event groups scoring below 20, despite internal data indicating that lower-scoring activities frequently met the criteria for mandatory Suspicious Activity Reports (SARs).

While Merrill Lynch neither admitted nor denied the findings, the firm has since lowered its internal review threshold to capture the previously overlooked activity. The SEC noted that the bank cooperated with the probe and has begun filing the missing reports. Bank of America representatives did not provide comment on the settlement.