Register
Sign in
Menu
.jpg)
.jpg)
A suspicious transaction alert can look straightforward at first.
A customer sends an unusually large wire. A new beneficiary appears without an obvious business purpose. Funds move through several accounts in a short period of time. The monitoring system identifies the activity and sends it to an analyst for review.
However, identifying unusual activity is not the same as understanding it.
The analyst still has to determine whether the transaction is a one-off event, part of a broader laundering pattern, or connected to a fraud scheme that has already affected other victims and institutions. They also need to document their reasoning, escalate the case when appropriate, and make those decisions before the funds move again or the relevant evidence disappears.
That is where AML execution is tested.
The recent enforcement actions against Bank of America and American Express are important because they bring that point into focus. Both cases involved substantial penalties, but the deeper lesson is not simply that banks need more technology or more alerts. It is that a financial-crime program can fail when the work that follows an alert is too slow, fragmented, or poorly supported.
On October 13, 2026, FinCEN assessed a $1.2 billion penalty against Bank of America. FinCEN said the bank willful Bank Secrecy Act violations, including failures to maintain a compliant AML program and file Suspicious Activity Reports, or SARs.
The related consent order says the bank failed to file timely and accurate SARs on more than $5 billion in suspicious transactions. More than $1 billion of that activity involved national-security-related and other priority illicit-finance risks.
Read FinCEN’s announcement and the consent order.
Days earlier, American Express received a $350 million penalty. Regulators cited insufficient AML resources, inexperienced staff, weak training, and internal-control gaps that affected the review and reporting of roughly $13 billion in suspicious activity.
The facts in each action are different. Still, both cases point to the same operational reality: detection is only one part of an AML program.
A bank can have transaction-monitoring rules, sanctions screening, customer due diligence, case-management software, and trained teams. Yet the program still depends on whether an investigator can take the alert in front of them and turn it into a timely, well-supported decision.
Transaction monitoring is designed to identify activity that may be unusual. An AML alert investigation is where the bank decides whether that activity is suspicious and what should happen next.
The FFIEC BSA/AML Examination Manual expects banks to have procedures for monitoring, identifying, researching, and reporting suspicious activity. It also expects timely alert review, appropriate research, clear escalation, and adequate staffing.
See the FFIEC examination procedures.
This is not a simple administrative step.
An alert may show that a customer made a payment outside their expected behavior. It may identify rapid movement of funds, a new counterparty, or a transaction that does not make sense based on the account profile. Those are valid reasons to investigate further.
However, the alert cannot answer every question on its own.
It cannot establish why the payment was made. It cannot always show who is behind the beneficiary account. It cannot reveal whether a related institution has seen the same subject or whether law enforcement already holds information that changes the significance of the activity.
That missing information can be the difference between a routine review and a time-sensitive case.
Financial crime rarely stays within one product, one system or one organization.
A payment-monitoring system may flag a wire transfer. The bank’s case-management platform may show earlier activity involving the customer. A fraud team may have received a complaint connected to the same phone number. The AML analyst may also need to review KYC information, prior SARs, sanctions-screening results, transaction history and public-source information.
At the same time, law enforcement may already have a victim report or active investigative interest tied to the account, wallet, email address, business, or other identifier under review.
The challenge is that these facts do not naturally arrive in the same place.
Each team may have a legitimate but limited view of the activity. The fraud team sees a customer complaint. The AML team sees a transaction pattern. Law enforcement may see the same identifier across several victim reports or a wider investigation.
Taken separately, each fact may look inconclusive. Taken together, they may justify a different level of review, urgency, or escalation.
This does not mean banks should collect every possible data point or escalate every ambiguous alert. More data does not automatically produce more clarity. What investigators need is relevant information that can be understood, attributed, and documented.
A defensible AML decision should show what the team reviewed, which facts mattered, and why the bank filed, escalated, or closed the case.
The FFIEC’s SAR Quality Guidance says a SAR narrative should explain who was involved, what happened, when and where it happened, why the activity was suspicious, and how it was carried out. Where relevant, it should also explain the source and destination of funds.
Read the SAR Quality Guidance.
That standard becomes more practical when banks focus on three things.
First, the alert should begin the research process rather than end it. The investigator needs to examine the customer, transaction history, related parties, and facts that explain the activity.
Second, urgent cases need a clear route to escalation. Teams should know who can make a time-sensitive decision and how that decision will be recorded.
Third, the reasoning needs to stay with the case. A future reviewer should be able to understand what the analyst knew at the time and why the bank reached its conclusion.
Deconflict does not replace transaction monitoring, sanctions screening, case management, or a bank’s legal and compliance judgment. Those systems remain essential.
Deconflict's Signal adds context to the review process already used by AML teams. Alongside the activity identified by transaction monitoring, it can show whether participating law-enforcement agencies have contributed relevant intelligence connected to the wallet, counterparty, account, or case under review.
That does not replace transaction monitoring or make the decision for the analyst. It gives the team another source of evidence to consider when investigating, escalating, and documenting potential financial crime.
In some cases, the next step may be appropriate contact with the contributing agency. Nexus provides a secure, attributable channel for that coordination, so teams are not left relying solely on fragmented email and phone exchanges.
That is useful when teams need to decide whether an alert is routine, connected to a broader case, or urgent enough to require a different response.
SAR quality is not only a compliance issue. It affects what law enforcement can do with the information a bank provides.
FinCEN reported that financial institutions and other filers submitted 4.8 million SARs in fiscal year 2025. Authorized users conducted more than 63.9 million searches of BSA data that year. FinCEN also reported that 11.7% of IRS-CI investigations opened in FY2025 originated from a BSA filing, and 89.3% of those were initiated from a SAR.
A useful SAR gives investigators a coherent picture of the activity, the people and entities involved, the movement of funds, and the reason the institution considered the activity suspicious.
That work starts long before the narrative is written. It starts when an analyst decides what an alert actually means.
The lesson from recent enforcement actions is not that banks need to generate more alerts.
The better question is whether the right investigator can access the facts needed to assess an alert, determine what requires escalation, and document a decision that remains clear months later.
An alert is only the first clue. The investigation that follows determines whether it becomes a missed opportunity or a well-supported action.
To see how Signal brings verified law-enforcement intelligence into existing bank workflows, talk to Deconflict.
It is the review that follows unusual activity identified by transaction monitoring or another control. The investigator researches the facts, documents the analysis, and makes or recommends a disposition.
No. Banks must assess the available facts under their BSA/AML policies and applicable requirements.
It can help an investigator understand whether an identifier under review may be connected to a victim report or active investigative matter. It should inform, not replace, the bank’s judgment.
A match indicates that an identifier may have verified law-enforcement relevance. It is not proof of wrongdoing and does not prescribe a particular action.
No. Deconflict complements existing financial-crime workflows by adding verified law-enforcement context where it is relevant.