A $7.5 million (£5.7 million) penalty against Merrill Lynch, Bank of America's wealth-management and brokerage business, has exposed a weakness in automated financial crime detection: software can successfully flag unusual activity while a human-set threshold still prevents some of it from reaching investigators.
The Securities and Exchange Commission found that Merrill's transaction-monitoring process grouped potentially suspicious events and assigned them risk scores. Only groups scoring 20 or higher were routinely investigated for possible Suspicious Activity Reports (SARs), even though internal testing found some below that cutoff would have resulted in reports if reviewed.
