CommunityBank of Texas FinCEN $8 Million Penalty: Understaffed AML Office, Closed Alerts and Unfiled SARs

In December 2021, the Financial Crimes Enforcement Network (FinCEN) announced an $8 million civil money penalty against CommunityBank of Texas, N.A. (CBOT) for willful violations of the Bank Secrecy Act. It is a useful case for anyone who works in or audits a regional bank, because it shows how an anti-money laundering (AML) function can fail without any single dramatic event: too few analysts, alerts closed on pre-set reasons, informal exemptions for familiar customers, and suspicious activity reports (SARs) that were never filed. The facts below come from FinCEN's consent order (No. 2021-03) and its press release.

The case at a glance

FinCEN assessed an $8 million penalty. The Office of the Comptroller of the Currency (OCC) separately imposed a $1 million penalty on the bank for related violations, and FinCEN agreed to credit that amount, so the bank's payment to FinCEN was $7 million. If the bank had failed to pay the OCC penalty, the full $8 million would have been due to FinCEN. FinCEN found two willful failures: not implementing and maintaining an effective AML program, and not accurately and timely reporting suspicious transactions. The order covers the period from 1 January 2015 to 31 December 2019, unless it says otherwise.

Understaffing and alert handling

The order describes an AML office that was too small for the volume it faced. According to FinCEN, three analysts averaged about 100 case alerts a day, and they often did not review the supporting documents behind an alert. Analysts frequently closed alerts using pre-set reason codes without further analysis. In practice that means the monitoring system was producing alerts, but the review step was not producing conclusions.

The order also records that the BSA Officer applied undocumented exemptions for customers regarded as well known, which removed around 1,000 alerts in 2019. An exemption can be a legitimate tuning decision, but it needs a written rationale, an approval path and periodic review. A familiar name is not a risk assessment. This pattern echoes the USAA enforcement action, where staffing and backlogs were also central.

Customer due diligence gaps

FinCEN found that customer due diligence questionnaires were often not updated and that some high-risk customers were not asked key questions. High-risk monthly reports were not generated. The order's due diligence findings concern high-risk domestic customers; it does not discuss foreign correspondent accounts. Due diligence is the baseline that gives monitoring its meaning: if the bank does not know what a customer should be doing, an unusual pattern is hard to recognise.

The unreported suspicious activity

FinCEN states that the bank failed to report hundreds of suspicious transactions, including transactions processed after the bank knew certain customers were subjects of criminal investigations. The order says at least 17 SARs were willfully not filed, or were filed late or inaccurately. The press release links the unreported activity to tax evasion, illegal gambling, money laundering and other financial crimes, and says millions of dollars in suspicious activity went unreported or was reported late or inaccurately.

The order discusses three customers in detail, described without names: an illegal sports gambling operation, an alleged illegal gambling ring, and a chemical trafficking organisation. The point for practitioners is that the bank had information, including knowledge of criminal investigations, that should have fed directly into its reporting decisions. Our guide to suspicious activity reporting covers what a timely, complete SAR needs to contain.

What the bank did in response

The order lists several remedial steps. The former AML office employees resigned and the BSA Officer retired. A new Director of Financial Crimes was hired in November 2019. AML staffing was increased, and on-demand staff augmentation was being set up. The bank carried out a suspicious activity lookback and backfiled 17 SARs. A Special Committee of the Board oversaw the response to FinCEN's investigation.

Lessons for compliance teams

First, measure capacity against alert volume. If analysts cannot review supporting documents inside the time available, the programme has a resourcing problem, not a tuning problem. Second, document every exemption and revisit it. Third, record a reason for every closed alert that is specific to the alert, not a generic code. Fourth, keep due diligence current for high-risk customers, because stale profiles undermine every later decision. Fifth, treat knowledge that a customer is under criminal investigation as a trigger to review the relationship and the reporting position. Teams weighing automation for these problems can start with our overview of AI in AML transaction monitoring. For structured learning on financial crime and professional ethics, see the Learnsignal CPD courses.

How the penalty was framed

The order cites the statutory ceilings that applied to violations after 2 November 2015. For the AML programme violation, the ceiling was up to $59,017 for each day of the violation. For the reporting violation, the order cites a per-violation cap of $236,071 and a floor of $59,017. The consent order also lists enforcement factors, including that the bank failed to report hundreds of suspicious transactions. The order sets out the factors FinCEN weighed, including the remedial steps the bank had taken.

A practical self-check

If you run or review a monitoring function, three questions from this case are worth asking this quarter. How many alerts does each analyst handle in a day, and is that number written down anywhere? For alerts closed last quarter, can a reviewer who was not involved see from the file alone why each one was closed? And is there a list of customers or alert types excluded from monitoring, with a named approver and a review date? If any answer is uncertain, the gap is the same kind of gap that FinCEN described here.

What we could not confirm

The signature date line in the text of the order we read was blank, so we use the date of FinCEN's press release, 16 December 2021. The order does not describe specific failures in independent testing or training, so we do not either. The three customers are anonymised, and the dollar value of the unreported transactions is described only as millions in FinCEN's press release. We have relied on FinCEN's account and have not reviewed the OCC's separate order.