Merrill’s third SEC SAR case shows the threshold changed from $25,000 to a risk score of 20

Merrill Lynch’s June 2026 suspicious-activity-report settlement was the SEC’s third such case against the broker in less than nine years. The three orders reveal a progression that disappears when each fine is read alone. In 2017, monitoring excluded accounts and failed to investigate alerts. In 2023, an enterprise fraud unit applied a bank’s $25,000 no-suspect threshold to a broker-dealer legally subject to $5,000. In 2026, an enterprise system investigated only event groups scoring 20 or more even though internal analysis showed some sub-20 groups would produce SAR filings.[1][2][3][5]

The SEC penalties total $26.5 million: $13 million in 2017, $6 million in 2023 and $7.5 million in 2026. That sum is a historical reconstruction, not one coordinated current sanction. The 2017 and 2023 matters also had separate FINRA fines, but adding those to the SEC total would mix regulators and could suggest an all-in figure for the 2026 case that the record does not support.[1][3][5][6]

The periods and populations are not additive. The 2017 and 2023 cases overlap in calendar time but concern different mechanisms and suspicious-activity categories. The orders do not publish a deduplicated count of missed reports across all three cases. “Hundreds” in the 2023 order and “numerous” in 2026 therefore cannot be combined into an exact lifetime total.[1][3][5]

The legal threshold never changed

Broker-dealers must file SARs on qualifying suspicious transactions or patterns involving at least $5,000. The duty depends on knowledge, suspicion or reason to suspect the activity falls within specified categories, not on the transaction amount alone. A dollar threshold triggers the reporting framework; it does not make every transaction above it suspicious or every transaction below it irrelevant to a broader pattern.[1][3][5]

The 2023 case arose because Bank of America’s Fraud Investigations Group handled suspicious-activity work for both national-bank affiliates and Merrill. For national banks, no-suspect criminal activity can carry a $25,000 threshold. For a broker-dealer, the applicable threshold is $5,000. The enterprise policies used the bank figure for Merrill, a fivefold increase that excluded reportable no-suspect activity between January 2009 and November 2019.[3][4]

The affected customers were often victims rather than suspected perpetrators. The SEC identified unauthorised debit-card withdrawals, forged or altered cheques, account intrusions, identity theft and phone or internet scams. That detail changes the public-interest frame: a SAR programme does not only monitor customers for money laundering. It can also surface criminal use of an account or theft from the customer when no responsible suspect has yet been identified.[3][4]

An employee identified the threshold error around September 2019 and the proper $5,000 rule was implemented in November. The finding was not that Bank of America lacked any SAR programme. It was that a shared programme carried the wrong legal parameter across an entity boundary. Centralisation can create consistency and scale, but it also allows one inherited rule to misclassify an entire subsidiary’s obligations.[3]

By 2020, the exclusion rule was a score rather than a dollar amount

The 2026 order concerns a different gate. Bank of America’s Event Processor grouped potentially suspicious events and assigned each group a risk score. Only groups scoring 20 or more were investigated for potential SAR filing. Internal analyses showed at least as early as April 2020 that some groups below 20 would result in SARs if reviewed. Merrill nevertheless failed to investigate those groups and consequently failed to file numerous reports through September 2024, according to the SEC.[1][2]

The order does not publish the scoring formula, the number of sub-20 groups, their score distribution or the number of SARs that each score band would have produced. It would therefore be unsafe to reverse-engineer operational thresholds or imply that all sub-20 activity was suspicious. What the record establishes is governance: the firm possessed evidence that the cutoff excluded reportable cases yet continued using it as an investigation gate.[1]

That is materially different from a model that occasionally makes an unpredictable false-negative error. A threshold always trades review workload against detection. Once validation demonstrates that a below-threshold population contains reportable cases, management needs a documented response—recalibration, supplemental scenarios, sampling, a secondary review or a reasoned risk acceptance consistent with the legal duty. The SEC found that Merrill’s independent obligation was not satisfied by reliance on the parent company’s enterprise programme.[1][2]

The 2017 case had already exposed Event Processor and coverage gaps

The 2017 order shows that the Event Processor architecture was not new to the later case. Merrill’s Mantas monitoring system fed events into the enterprise processor, which grouped and scored them. During a four-month change programme, the firm stopped investigating event groups generated only by Mantas and did not review hundreds of existing alerts. FINRA’s parallel account of the same period said 1,015 instances of potentially suspicious activity were not investigated at the time.[5][6]

The SEC also found that millions of accounts were excluded from automated monitoring before May 2015 and that Merrill failed to monitor continuing suspicious activity adequately. In one example, the firm did not timely file seven SARs covering approximately $57 million across roughly 20 accounts because it decided not to reprocess, rescore and investigate events after scoring changes. Those figures belong to specific 2017 findings; they cannot be used as a proxy for the later cases.[5]

The pattern across the orders is therefore not one unchanged software bug. The first case involved population coverage, alert handling, score changes and continuing-activity monitoring. The second involved a legal dollar threshold imported from bank rules. The third involved a risk-score cutoff retained despite contrary validation. Treating them as one repeated technical defect would miss how a SAR programme can fail at multiple layers.[1][3][5]

Enterprise control did not transfer the broker’s liability

All three matters sit inside a group structure. Merrill is an indirect wholly owned Bank of America subsidiary and relied on central teams or systems. The orders repeatedly preserve the regulated-entity boundary: a parent can operate the process, but the broker-dealer remains responsible for complying with Exchange Act recordkeeping and FinCEN reporting rules. Shared technology is an operating arrangement, not a legal passport.[1][3][5]

The boundary is especially important when a platform serves banks and broker-dealers. The entities can have different thresholds, products, account structures and source systems. A control inventory that says “enterprise AML” is incomplete unless it maps each scenario and parameter to the entity whose obligation it fulfils. The 2023 threshold case is a direct demonstration; the 2026 score case shows that even a common model’s validation must be interpreted at subsidiary level.[1][3]

The penalty total is real, but not a performance metric

The $26.5 million SEC total quantifies sanctions, not the economic value of missed SARs or the proceeds of criminal activity. SARs are intelligence reports, and filing one is not an accusation or finding against a customer. The orders also resolved civil administrative proceedings: Merrill did not admit or deny the 2017, 2023 or 2026 SEC findings except for jurisdictional and settlement provisions stated in the documents.[1][3][5]

Nor can the penalties be divided by an assumed number of missed reports. The SEC does not publish an exact report count in 2026, and “hundreds” in 2023 is not a numeric denominator. The sanctions reflect duration, recurrence, legal obligations, remediation and other factors not reducible to a fee per SAR. The recurrence is nevertheless material because the 2026 order expressly identifies the two prior SEC proceedings.[1][2][3][5]

What would falsify the wider conclusion

The records support a conclusion that Merrill’s SAR failures occurred at several distinct control layers under a shared enterprise framework. They do not prove that the same defect persisted continuously from 2009 through 2024, that every unreviewed event warranted a SAR or that current controls remain deficient. Evidence of complete entity-level coverage, correctly mapped legal thresholds, independent score-band testing and documented review of lower-scoring populations would address the mechanisms identified in the orders.[1][3][5]

The next verifiable question is whether the programme can demonstrate that validation findings change production controls. The 2026 case is consequential not because a score of 20 is inherently wrong. It is consequential because internal analysis had shown that the cutoff excluded some reportable cases. A model threshold becomes a governance failure when evidence against it is known, the legal entity retains the duty, and the operating process does not respond.[1][2]

Read together, the three cases show the evolution of a compliance denominator. First, some accounts and alerts were outside effective review. Then a bank’s $25,000 rule displaced a broker’s $5,000 rule. Finally, a risk score of 20 displaced the evidence contained in the lower-scored population. The legal reporting threshold remained $5,000 throughout. What changed was the operational gate placed in front of it.[1][3][5]

Report an error or submit an update