USAA Federal Savings Bank FinCEN $140 Million Penalty: AML Lessons

The United Services Automobile Association's federal savings bank (USAA FSB) is a retail bank that serves military members and their families. In March 2022 the US Financial Crimes Enforcement Network (FinCEN) assessed a $140 million civil money penalty against it for willfully failing to maintain an adequate anti-money laundering (AML) programme and to report suspicious transactions accurately and on time. FinCEN credited $60 million for the penalty assessed by the Office of the Comptroller of the Currency (OCC), so USAA FSB pays $80 million to the US Treasury. The case is a clear lesson in what happens when a bank grows faster than its compliance function: vacancies, contractors, an untuned monitoring system and a backlog of tens of thousands of alerts. To build your AML knowledge, see our CPD courses.

This guide is based on FinCEN consent order number 2022-01. We read it through a summarising tool, so check every figure against the order before you quote it.

The penalty and the period

The relevant period is 1 January 2016 to 30 April 2021. The order cites the AML programme rule (31 U.S.C. 5318(h) and 31 C.F.R. 1020.210), the suspicious activity reporting rule (31 U.S.C. 5318(g) and 31 C.F.R. 1020.320) and FinCEN's civil penalty authority. USAA FSB admitted willfulness only in the civil sense, meaning reckless disregard or willful blindness. If the bank failed to pay the OCC penalty, it would owe the full $140 million. The text we read does not give the signing date; FinCEN's enforcement list shows 17 March 2022.

An AML programme that did not scale

Staffing and contractors

The order calls the programme "rudimentary" in 2017. In early 2021 the bank needed 178 positions in its compliance function and 62 were vacant, including the head of the financial intelligence unit. About 76% of compliance staffing was supplemented by contractors, who were not adequately trained or qualified. Training was not tailored to the bank's risk profile or typologies.

Independent testing that missed the problems

A 2016 internal audit report rated BSA compliance "generally satisfactory", a conclusion later reviews found deficient.

Customer risk scores that never said high

Account-opening information was insufficient, and the customer risk score model assigned arbitrary sub-scores of 1 or 2 where data was missing. Of about six million scores, none reached the high-risk threshold of 5.5. An internal bank report on this was ignored. A risk model that cannot return a high score is not a risk model. Our guide to the Shinhan Bank America order describes a similar problem with customer ratings.

Transaction monitoring that was not tuned

The legacy system, in use from 2014, lacked key information. Forty per cent of active scenarios had not been tuned in over two years, and six were never tuned. Control limits for remote deposit capture and ATM activity were inappropriately high. A new system launched in the first quarter of 2021 after two months of parallel testing, and it failed to flag more than 1,300 cases that the legacy system had flagged, resulting in at least 160 SARs that would not have been filed. By the end of 2021 there was a backlog of about 90,000 unreviewed alerts and 6,900 unreviewed cases, projected to reach 120,000 alerts and 24,000 cases.

Late suspicious activity reports

At least 3,873 SARs were willfully filed late between 31 August 2017 and 31 August 2021, an average of 226 days after the suspicious activity ended, and almost 10% of all SARs filed in that period. The order gives examples. One customer, a physician, made 76 deposits from a virtual currency exchange totalling about $1.5 million between October 2020 and March 2021, and about 2,800 ATM withdrawals totalling about $1.6 million in Colombia, but the SAR was filed around seven months after the conduct began. In another case, two customers deposited 3,457 small cheques by remote deposit capture, each worth $3 to $17 and each intended for baby formula companies, over 15 months without a SAR. Our suspicious activity reporting guide explains what a timely SAR requires.

Remediation and undertakings

The bank did not voluntarily disclose the violations. It says it has invested about $500 million in an AML overhaul since 2019, carried out lookbacks including on remote deposit capture, and provided status updates. Its 2018 commitments to the OCC, due on 31 March 2020 and extended to 30 June 2021, had not all been met, and three corrective actions from 2017 remained open in early 2021. The order's own undertakings are payment within 10 days, full cooperation, six-year record retention, no contradictory public statements and successor compliance.

Practical lessons

• Fund and fill the function. Vacancies in the head of the financial intelligence unit and heavy use of contractors were central findings.
• Test your risk model with real data. If no customer can score high, the model is broken.
• Run old and new monitoring systems in parallel. Compare alerts and investigate the gaps before switching over.
• Tune on a schedule. Scenarios untouched for two years are an easy finding.
• Measure SAR timeliness. An average delay of 226 days is not defensible.
• Close prior commitments. Missed regulator deadlines add to the penalty.

For a far larger case with similar themes, see our TD Bank guide.

Frequently asked questions

How much did USAA FSB pay?

The penalty is $140 million; after crediting $60 million for the OCC penalty, $80 million is payable to the Treasury.

Why were so many SARs late?

The order points to staffing shortfalls, a backlog of alerts and a monitoring system that was not tuned.

Was the violation willful?

FinCEN found willful violations, with USAA FSB admitting willfulness only in the civil sense.

What we could not confirm

We read FinCEN's consent order through a summarising tool. The signing date is blank in the text we read, and the order cites both a 30-day SAR deadline and a 60-day maximum without reconciling them. Please check all figures against the original document.