When Bank of America was fined $1.2 billion for "deficient and ineffective" AML processes and "egregious and continued" violations of the Bank Secrecy Act, it wasn't a single catastrophic failure. It was a cascade of control breakdowns that compounded over time.
You can't prevent what you don't measure. This template gives you a structured post-mortem checklist to run after any AML control failure, whether it's a missed SAR, a sanctions screening gap, or a transaction monitoring blind spot. Use it to document what went wrong, identify root causes, and build remediation plans that satisfy examiners.
Purpose of the Template
This post-mortem checklist helps you systematically analyze AML control failures and document corrective actions in a format examiners recognize. It's designed for:
- Incident response after a missed Suspicious Activity Report, late filing, or screening failure
- Exam preparation when regulators identify deficiencies during BSA/AML reviews
- Internal audit findings that require formal remediation tracking
- Board reporting when governance committees need to understand control breakdowns
The template follows the structure FinCEN and banking regulators expect: what happened, why it happened, who's accountable, and how you're fixing it.
Prerequisites
Before you use this template, ensure you have:
- Incident documentation, the specific transaction(s), alert(s), or customer file(s) where the failure occurred
- Timeline reconstruction, when the failure was detected, how long it persisted, and when it was escalated
- Policy and procedure references, the specific sections of your AML/CFT Framework that should have prevented this
- System logs or audit trails, evidence of what your transaction monitoring rules, name screening tools, or case management system did (or didn't do)
- Stakeholder access, input from front-line staff, analysts, IT, and compliance leadership
Don't start this process until you've preserved all evidence. If you're dealing with a potential SAR scenario, file the SAR first. Safe Harbor protections don't apply retroactively.
The Template
Copy this into your incident management system or compliance documentation repository:
AML CONTROL FAILURE POST-MORTEM
Incident ID: [Assign a unique tracking number]
Date of Failure: [When the control should have worked but didn't]
Date of Detection: [When you discovered the failure]
Prepared by: [Name, Title]
Review Date: [When this will be reviewed with senior management]
SECTION 1: FAILURE DESCRIPTION
What happened:
[Describe the specific control failure in plain language. Example: "A wire transfer of $47,000 to a Grey List jurisdiction did not generate a transaction monitoring alert because the destination country field was not configured in our monitoring rules."]
Affected transactions/customers:
[Quantity and brief description. Don't include customer names in this section if it will be shared beyond the compliance team.]
Regulatory obligations implicated:
[List specific BSA requirements, such as 31 CFR 1020.210 for Customer Due Diligence or 31 CFR 1020.320 for Suspicious Activity Reports]
Potential exposure:
- Suspicious Activity Report obligation? [Yes/No, if yes, reference the SAR number if already filed]
- Regulatory reporting deadline missed? [Yes/No]
- Customer risk rating incorrect? [Yes/No]
SECTION 2: ROOT CAUSE ANALYSIS
Immediate cause:
[The direct technical or procedural breakdown. Example: "The transaction monitoring rule for high-risk jurisdictions excluded wire transfers below $50,000."]
Contributing factors:
[Check all that apply and explain]
- Policy gap, no written procedure covering this scenario
- System configuration, tool wasn't set up to detect this pattern
- Training deficiency, staff didn't recognize the red flag
- Staffing/workload, analyst didn't have time to review properly
- Escalation failure, issue was identified but not escalated to MLRO
- Data quality, missing or incorrect customer information prevented detection
- Vendor/third-party, service provider didn't deliver expected controls
Why existing controls failed:
[Explain the gap between your written AML/CFT Framework and what actually happened. Reference specific policy sections.]
SECTION 3: ACCOUNTABILITY AND OWNERSHIP
Control owner:
[The person or team responsible for maintaining this control]
Notification timeline:
- MLRO notified: [Date/Time]
- Senior management notified: [Date/Time]
- Board committee notified: [Date/Time or "Pending"]
Regulatory notification required:
[Yes/No, if yes, specify which regulator and deadline]
SECTION 4: REMEDIATION PLAN
Immediate actions taken:
[What you did within 24-48 hours to contain the issue]
Short-term fixes (30 days):
| Action | Owner | Deadline | Status |
|---|---|---|---|
| [Example: Reconfigure transaction monitoring rule to include all wire transfers to Grey List jurisdictions regardless of amount] | [Name] | [Date] | [Not Started/In Progress/Complete] |
Long-term improvements (90 days):
| Action | Owner | Deadline | Status |
|---|---|---|---|
| [Example: Conduct gap analysis of all transaction monitoring rules against FATF Recommendation 6 and Recommendation 7 requirements] | [Name] | [Date] | [Not Started/In Progress/Complete] |
Policy/procedure updates required:
[List specific sections of your AML/CFT Framework that need revision]
Training plan:
[Who needs retraining, on what topic, by when]
System enhancements:
[Any RegTech tool configurations, new data sources, or workflow changes]
SECTION 5: LOOKBACK AND VALIDATION
Lookback period: [How far back you reviewed for similar failures]
Lookback methodology: [Query parameters, sample size, review criteria]
Additional issues identified: [Number and brief description]
SARs filed from lookback: [Count and date range]
Validation testing:
- Remediated control tested with known-bad scenarios
- Independent testing by [Internal Audit/External Consultant/Other]
- Test results documented in [System/Location]
- Senior management sign-off on effectiveness
Monitoring plan:
[How you'll track whether the fix is working, specific metrics, review frequency, escalation triggers]
SECTION 6: LESSONS LEARNED
What we'll do differently:
[Specific, actionable changes to prevent recurrence]
Cross-functional impacts:
[Other teams or controls affected by this failure or the remediation]
Regulatory guidance consulted:
[FinCEN advisories, FFIEC BSA/AML Examination Manual sections, or other authoritative sources that informed your response]
Sign-off:
MLRO: _________________________ Date: _________
Senior Management: _________________________ Date: _________
Customizing the Template
Adjust for your institution's size:
If you're a small fintech, you might not have separate Internal Audit or Board committee review steps. Combine the MLRO and senior management sign-off. If you're a large bank, add lines for Regional Compliance, Legal, and Enterprise Risk.
Tailor Section 2 to your control environment:
The contributing factors checklist should reflect your actual AML/CFT Framework components. If you outsource transaction monitoring to a service provider, add a checkbox for "vendor SLA breach." If you operate in multiple jurisdictions, add "cross-border coordination failure."
Scale the lookback based on risk:
For a one-off missed alert on a low-risk customer, a 90-day lookback might suffice. For a systemic transaction monitoring rule failure, you're looking at 12-24 months minimum. Justify that scope to examiners.
Link to your existing incident response process:
If you already have a Suspicious Activity Report escalation workflow or a compliance incident tracking system, reference those ticket numbers in Section 1. Don't create a parallel documentation process.
Validation Steps
Before you consider this post-mortem complete:
- Run the remediated control against historical data, take the transactions that should have alerted and confirm your fix would catch them now.
- Have someone outside the compliance team review Section 2, fresh eyes catch gaps in root cause logic.
- Confirm your lookback methodology with your MLRO or outside counsel, if regulators question your scope, you need a defensible rationale.
- Schedule a 90-day follow-up, put a calendar reminder to review whether your monitoring plan (Section 5) is actually being executed.
- Archive everything, examiners will ask for post-mortem documentation years later; make sure it's retrievable.
The Bank of America penalty wasn't about a single oversight. It was about repeated failures and ineffective remediation. Your post-mortem process is your proof that when controls break, you fix them systematically and verify the fix works.
If you're using this template after an examiner has already identified the deficiency, add a cover memo explaining when you discovered the issue internally versus when the examiner flagged it. That timeline matters for demonstrating self-governance versus reactive compliance.
