The U.S. Securities and Exchange Commission (SEC) has once again placed Anti-money laundering (AML) compliance in the spotlight after imposing a $7.5 million civil penalty on Merrill Lynch, Pierce, Fenner & Smith Incorporated. The enforcement action stems from the firm’s failure to submit required Suspicious Activity Reports (SARs) over several years, despite identifying weaknesses in its transaction monitoring process.
The latest case is significant not only because of the financial penalty but also because it marks another regulatory action against Merrill Lynch involving SAR reporting. For financial institutions, the decision reinforces a growing regulatory expectation that AML monitoring systems must be continuously tested, updated, and supported by effective governancenot simply deployed and left unchanged.
The SEC’s findings also send a broader message across the banking and brokerage industry: firms are expected to identify suspicious financial activity promptly, regardless of whether the failures stem from technology, internal processes, or human oversight.
SEC Identifies Years of Reporting Failures
According to the SEC’s order, Merrill Lynch failed to file numerous Suspicious Activity Reports between April 2020 and September 2024 after weaknesses emerged in its automated transaction monitoring process. The regulator concluded that the firm’s monitoring methodology caused certain potentially suspicious transactions to go unreviewed, preventing SARs from being filed when required.
Rather than accusing the firm of facilitating money laundering, the SEC focused on failures within Merrill’s compliance controls and reporting obligations under the Bank Secrecy Act.
Without admitting or denying the SEC’s findings, Merrill Lynch agreed to:
- Pay a $7.5 million civil penalty.
- Accept a formal censure.
- Cease and desist from future violations related to SAR reporting requirements.
The settlement resolves the SEC’s investigation but places renewed attention on how broker-dealers manage financial crime detection programs.
How the Compliance Gap Developed
The SEC found that Merrill relied on Bank of America’s enterprise-wide AML transaction monitoring platform to review customer activity.
Within that system, suspicious transactions were grouped into “Event Groups.” Each group received a numerical risk score based on transaction characteristics and predefined risk factors.
Only Event Groups scoring 20 or higher were automatically reviewed by investigators.
Internal analysis reportedly showed as early as 2020 that some lower-scoring Event Groups could also contain reportable suspicious activity. Despite those findings, the review threshold remained unchanged until late 2023.
As a result, numerous transactions that should have received additional review were never investigated, and corresponding Suspicious Activity Reports were not submitted to the Financial Crimes Enforcement Network (FinCEN).
The SEC viewed this as a failure to maintain an AML program reasonably designed to identify and report suspicious activity.
What Is a Suspicious Activity Report?
A Suspicious Activity Report, commonly known as a SAR, is one of the financial industry’s most important tools for combating financial crime.
Banks, broker-dealers, credit unions, and other regulated financial institutions must file SARs whenever they detect transactions that may involve:
- Money laundering.
- Fraud.
- Identity theft.
- Terrorist financing.
- Insider abuse.
- Structured cash transactions.
- Other potentially illegal financial activity.
Importantly, filing a SAR does not mean a crime has occurred.
Instead, it alerts FinCEN and law enforcement agencies that a transaction warrants further attention.
Thousands of criminal investigations begin with SAR information submitted by financial institutions.
Why Regulators Treat SAR Reporting So Seriously
AML compliance is built on early detection.
If suspicious transactions remain unnoticed, regulators and law enforcement agencies lose valuable opportunities to investigate organized financial crime.
The Bank Secrecy Act therefore requires broker-dealers to establish systems capable of:
- Monitoring customer transactions.
- Identifying unusual financial behavior.
- Escalating suspicious cases for review.
- Filing reports within required timeframes.
- Maintaining complete documentation supporting reporting decisions.
Technology plays an increasingly important role in this process, but regulators consistently emphasize that automated systems must be properly calibrated and regularly tested.
An ineffective monitoring threshold can create the same compliance risk as having no monitoring system at all.
The Latest Penalty Continues a Pattern
The June 2026 settlement is not Merrill Lynch’s first regulatory action involving Suspicious Activity Reports.
Over the past decade, regulators have repeatedly identified weaknesses in the firm’s AML reporting processes.
One of the most significant enforcement actions occurred in 2023, when the SEC and FINRA imposed combined penalties totaling $12 million after Merrill failed to file approximately 1,500 SARs over a ten-year period.
That earlier case stemmed from the incorrect use of a $25,000 reporting threshold inherited after Bank of America’s acquisition of Merrill Lynch. Broker-dealers are generally required to apply a lower threshold than national banks in many SAR-reporting scenarios, resulting in hundreds of missed filings before the issue was corrected.
The latest action differs because it focuses on transaction monitoring methodology rather than reporting thresholds.
Together, the cases demonstrate how regulators increasingly evaluate not only written AML policies but also the effectiveness of the technology supporting them.
Timeline of Merrill Lynch’s Recent AML Enforcement
| Year | Regulatory Action | Outcome |
| 2017 | Earlier SEC enforcement involving SAR reporting deficiencies | Civil penalty and remediation requirements |
| 2023 | SEC and FINRA found nearly 1,500 missed SAR filings due to incorrect reporting thresholds | $12 million in combined penalties |
| 2026 | SEC identified monitoring system weaknesses that prevented review of suspicious transactions | $7.5 million civil penalty |
The repeated enforcement history highlights regulators’ expectation that firms address compliance weaknesses permanently rather than through temporary corrective actions.
Why This Case Matters Beyond Merrill Lynch
Although the enforcement action targets one brokerage firm, the implications extend across the financial services industry.
Modern AML programs increasingly depend on artificial intelligence, machine learning, transaction monitoring software, and automated risk scoring.
Those technologies help compliance teams review millions of transactions every day.
However, regulators continue to stress that automation cannot replace governance.
Risk models require continuous validation.
Alert thresholds require periodic review.
Compliance officers must verify that technology identifies suspicious activity as intended.
Otherwise, firms risk overlooking transactions that should be investigated.
The Merrill Lynch settlement reinforces a simple regulatory principle: an automated system is only as effective as the rules that govern it.
Similar Enforcement Actions Show a Broader Regulatory Trend
The Merrill Lynch settlement is not an isolated event. Over the past several years, U.S. regulators have consistently taken action against financial institutions whose AML programs failed to detect, investigate, or report suspicious activity effectively.
While every case involves different facts, regulators continue to focus on the same underlying issues: ineffective monitoring systems, inadequate staffing, weak governance, and delayed remediation.
The pattern suggests that regulators are no longer evaluating whether firms simply have AML policies in place. Instead, they want evidence those policies work in practice.
Some recent examples include:
- In early 2026, FinCEN imposed an $80 million civil penalty against a broker-dealer for maintaining ineffective AML controls, failing to review surveillance reports, and not filing required Suspicious Activity Reports. The enforcement action, coordinated with the SEC and FINRA, became the largest Bank Secrecy Act penalty ever issued against a broker-dealer.
- In January 2025, the SEC fined LPL Financial $18 million after finding long-standing failures in its customer identification program and weaknesses involving thousands of high-risk accounts that remained open despite internal AML policies.
- In 2024, the Office of the Comptroller of the Currency (OCC) ordered Wells Fargo to strengthen its financial crime risk management framework after identifying deficiencies in AML controls and internal oversight.
These actions demonstrate that AML enforcement is expanding beyond traditional banking institutions to include broker-dealers, investment advisers, and other regulated financial firms.
What Financial Institutions Can Learn From the Merrill Lynch Case
One of the biggest lessons from the SEC’s order is that compliance programs cannot rely entirely on automation.
Transaction monitoring systems generate enormous amounts of data every day. However, if those systems are configured with inappropriate thresholds or outdated rules, suspicious transactions may never reach compliance investigators.
Organizations should regularly review:
| Compliance Area | Recommended Best Practice |
| Transaction monitoring | Validate risk-scoring models at scheduled intervals and after major business changes. |
| SAR investigations | Review alert thresholds periodically to ensure reportable activity is not excluded. |
| Governance | Require senior management to receive regular AML performance reports. |
| Independent testing | Conduct annual reviews of monitoring systems and reporting controls. |
| Staff training | Provide role-specific AML training that reflects current regulatory expectations. |
Rather than viewing AML as a regulatory obligation alone, many institutions now treat it as a core operational risk function.
Why Governance Matters as Much as Technology
Sophisticated monitoring software has become standard across large financial institutions. Even so, regulators continue to emphasize that software alone cannot ensure compliance.
The Merrill Lynch case illustrates this point clearly.
According to the SEC, internal analysis identified weaknesses in the firm’s monitoring methodology years before corrective action was taken. The concern was not simply that technology missed suspicious transactions, but that known deficiencies remained unresolved for an extended period.
This reinforces a growing regulatory expectation that firms should:
- Escalate identified compliance weaknesses quickly.
- Reassess monitoring thresholds whenever risk profiles change.
- Document governance decisions affecting AML systems.
- Test surveillance models using historical transaction data.
- Allocate sufficient staffing and resources to compliance teams.
Recent enforcement actions also show regulators increasingly scrutinize whether firms responded promptly after identifying internal control failures. Delayed remediation can become an aggravating factor when penalties are assessed.
Case Study: When Monitoring Thresholds Create Hidden Risks
Many financial institutions rely on automated systems to prioritize alerts based on risk scores. This approach helps compliance teams focus on higher-risk activity.
However, the Merrill Lynch enforcement action demonstrates how a seemingly reasonable threshold can unintentionally exclude transactions that deserve investigation.
The SEC concluded that certain lower-risk alert groups still contained activity that should have been reviewed for potential SAR filings. Because those alerts never reached investigators, reportable transactions went unreported for years.
The broader lesson is straightforward.
Alert thresholds should never remain static.
Compliance teams should continuously validate scoring models using historical cases, emerging financial crime trends, and changing customer behavior.
The Future of AML Compliance
Financial crime detection is becoming more technology-driven every year.
Artificial intelligence, machine learning, and predictive analytics now help financial institutions process millions of transactions that would be impossible to review manually.
At the same time, regulators increasingly expect firms to demonstrate how those technologies are governed.
Industry observers expect future examinations to focus on several key areas:
- AI model validation and ongoing performance monitoring.
- Risk-based customer due diligence.
- Independent testing of transaction surveillance systems.
- Data quality supporting automated monitoring.
- Board-level oversight of AML programs.
- Timely remediation of identified weaknesses.
For compliance leaders, technology investment alone will not satisfy regulators. Institutions must also demonstrate effective governance, documentation, and continuous improvement. Recent enforcement actions indicate that regulators are placing greater emphasis on whether AML programs are adequately staffed, independently tested, and supported by senior management.
Frequently Asked Questions
Why did the SEC fine Merrill Lynch?
The SEC found that Merrill Lynch failed to file numerous Suspicious Activity Reports after weaknesses in its transaction monitoring process prevented potentially suspicious transactions from being reviewed.
What is a Suspicious Activity Report?
A Suspicious Activity Report (SAR) is a confidential filing submitted to the Financial Crimes Enforcement Network (FinCEN) when a financial institution detects activity that may indicate money laundering, fraud, terrorist financing, or other financial crimes.
Did the SEC accuse Merrill Lynch of money laundering?
No. The enforcement action focused on failures to identify, investigate, and report suspicious transactions as required under the Bank Secrecy Act.
Why are SARs important?
SARs provide law enforcement agencies with valuable intelligence used to detect financial crime, investigate fraud, disrupt money laundering networks, and support national security efforts.
Has Merrill Lynch faced similar penalties before?
Yes. Merrill Lynch has previously settled regulatory actions involving Suspicious Activity Report failures, including enforcement actions in 2017 and 2023.
What regulations govern SAR reporting?
Broker-dealers must comply with the Bank Secrecy Act, FinCEN regulations, and SEC Rule 17a-8, which requires compliance with Bank Secrecy Act reporting obligations.
Can automated monitoring systems replace compliance professionals?
No. Regulators expect automated tools to support compliance teams, not replace human judgment. Monitoring systems require regular testing, calibration, and oversight.
What should financial institutions do after this enforcement action?
Organizations should review transaction monitoring models, validate alert thresholds, strengthen governance, conduct independent testing, and ensure AML programs receive sufficient staffing and executive oversight.
Conclusion
The SEC’s $7.5 million settlement with Merrill Lynch is another reminder that effective AML compliance depends on more than sophisticated technology. Regulators increasingly expect financial institutions to demonstrate that their monitoring systems, governance structures, and reporting processes work together to identify suspicious activity before risks escalate.
For broker-dealers, banks, and investment firms, the enforcement action reinforces several priorities: continuously validate transaction monitoring systems, respond quickly when weaknesses are identified, allocate adequate compliance resources, and maintain strong oversight at every level of the organization.
As financial crime becomes more sophisticated and regulators place greater emphasis on operational effectiveness, firms that regularly review and strengthen their AML programs will be better positioned to meet evolving compliance expectations while protecting both investors and the integrity of the financial system.
