TD Bank FinCEN $1.3 Billion Penalty: Record AML Failures Explained

On 10 October 2024 the US Financial Crimes Enforcement Network (FinCEN) assessed a $1.3 billion civil money penalty against TD Bank, N.A. and TD Bank USA, N.A. FinCEN describes it as a record, and the largest penalty against a depository institution in the history of Treasury and FinCEN. The bank admitted it willfully failed to maintain an anti-money laundering (AML) programme that met the Bank Secrecy Act (BSA) minimums. The consent order is among the most detailed public descriptions of what a failed AML programme looks like in practice, from unmonitored payment channels to a culture that treated compliance as a cost to be held flat. If you are building your AML knowledge, see our CPD courses.

This guide is based on the FinCEN news release and consent order number 2024-02. We read them through a summarising tool, and the order text was truncated, so check every figure against the original documents before you quote it.

The headline findings

The order covers a period from at least 2012 through 9 May 2024. The bank admitted the facts in its 10 October 2024 plea agreements with the US Department of Justice, and admitted willfulness only in the civil BSA sense of reckless disregard or willful blindness. The order cites the AML programme rule (31 U.S.C. 5318(h) and 31 C.F.R. 1020.210), suspicious activity reporting (31 U.S.C. 5318(g) and 31 C.F.R. 1020.320), currency transaction reporting (31 U.S.C. 5313 and 31 C.F.R. 1010.311) and civil penalties (31 U.S.C. 5321(a)). FinCEN's release says the Department of Justice, the Office of the Comptroller of the Currency and the Federal Reserve Board announced parallel actions the same day; we did not read those documents, so we do not state their terms, and the text we read does not say whether other agencies' payments were credited.

Where monitoring did not reach

The most striking part of the order is the list of channels that were not monitored. According to the order:

• Monitoring lacked codes for 98% of domestic automated clearing house (ACH) transactions, a gap the bank had known about since at least 2012.
• Roughly half of funds transfers went unmonitored, including international debit card purchases.
• Nearly all monetary instruments, including remote deposit capture, were unmonitored, and over 80% of that activity, in the trillions of dollars, was not covered.
• More than $100 billion of non-Zelle peer-to-peer payments, such as Venmo and PayPal, went unmonitored.
• For Zelle, about 300 million transactions worth over $75 billion between 2017 and 2023 were monitored with wire-oriented scenarios at high thresholds instead of scenarios designed for Zelle.
• Customers could exchange cash for bank cheques without depositing it until April 2021, and related scenarios were defective.

The lesson is that a monitoring system is only as good as its coverage. Our guide to the Bank of America consent order shows another case where the tuning of monitoring was the core finding.

Criminal networks and insiders

The order describes a network run by Da Ying Sze, an unlicensed money services business that laundered an estimated $650 million between 2016 and 2021, including more than $400 million through the bank. Sze pleaded guilty in February 2022, including to bribing bank employees, and gave at least $57,000 in gift cards to employees of financial institutions between 2020 and 2021. SARs did not identify both relevant persons as subjects, and currency transaction reports failed to record Sze more than 100 times. FinCEN's release puts the number of reports that failed to identify him at more than 500. The two figures differ, so check the order and release if you need to quote one.

The order and release also describe an employee who facilitated laundering of narcotics proceeds in 2021 in exchange for bribes, and other employee misconduct including embezzlement and pandemic loan fraud.

Funnel accounts, ATMs and high-risk jurisdictions

Funnel accounts, which take cash deposits in one place and have it withdrawn elsewhere, took an average of about 329 days to be exited between October 2019 and March 2022. A third-party analysis in late 2023 identified nearly 20,000 unique accounts involved. Colombia accounted for nearly half of a $750 million sample of ATM withdrawals in five high-risk Latin American and Caribbean jurisdictions, with withdrawals rising about 50% a year over four years. The order says the bank did not adequately control international ATM withdrawals until 2024, when it reduced limits in high-risk countries.

Suspicious activity that went unreported

• A Ponzi scheme produced more than 3,000 transactions exceeding $300 million between 2018 and 2023, and the bank filed SARs on only about 1% of them until a law enforcement inquiry in 2021.
• More than $3.5 million flowed through an HVAC customer over nine months in transactions consistent with human trafficking, and a SAR was filed late and only after law enforcement prompted.
• A precious metals customer's large cash activity continued for about a year after onboarding, until law enforcement enquiries.

FinCEN's release says the bank willfully failed to file SARs on thousands of suspicious transactions totalling about $1.5 billion. Our suspicious activity reporting guide explains why reporting is the point of a monitoring programme, not a by-product.

A culture of cost-cutting

The order links the technical failings to culture. It cites FinCEN's 2014 advisory on promoting a culture of compliance. It says the bank's approach was "pennywise, pound-foolish" and that managers described developing the AML programme "within a flat cost paradigm". AML spending was described as an order of magnitude below peers and stayed flat while assets grew. Management reportedly told staff to scale back the rigour of reviews. The order also says more than 1.6 million customers were never risk scored, and that management debated the issue and recommended no remedial work. These are the findings that make this case a governance case, not just a systems one.

Remediation and what the bank must do

The bank began large-scale remediation only after regulatory scrutiny. It replaced its BSA officer, raised staffing, updated training and strengthened policies, and AML staff nearly doubled over the six months to May 2024. A new transaction monitoring system began phased rollout in August 2024. The bank also proactively told FinCEN about an internal investigation into the HVAC customer. Under the release, the bank must have a four-year independent monitorship, an independent historical SAR lookback, an independent end-to-end review of its AML programme, an accountability review of staff involvement or failure to escalate, and a data governance review.

Practical lessons

• Map your channels. List every payment type you offer and confirm that each feeds monitoring with usable data.
• Fund the programme as the business grows. Compliance spend that stays flat while assets grow is a warning sign.
• Guard against insiders. Monitor employee conduct and gifts as well as customers.
• Risk-score every customer. Unscored customers cannot be monitored properly.
• Do not discourage escalation. Instructions to scale back rigour end up in the order.
• Exit funnel accounts faster. A year to demarket is too long.

For another large case with a similar combination of coverage gaps and slow reporting, read our UBS Financial Services case study.

Frequently asked questions

How much was the TD Bank penalty?

FinCEN assessed $1.3 billion, which it describes as a record against a depository institution.

Was there a monitor?

Yes. FinCEN's release describes a four-year independent monitorship.

Did employees take part?

The order describes bribery of bank employees by a laundering network and an employee who facilitated laundering of narcotics proceeds in 2021.

What we could not confirm

We read the FinCEN release and consent order through a summarising tool and the order text was truncated. The order text we read does not state the penalty amount, crediting of other agencies' payments, or the terms of the undertakings; those come from the release. The monitorship terms and the parallel DOJ, OCC and Federal Reserve actions should be checked against their original documents.