Block has reached a $964 million settlement with the DOJ, with $764 million addressing charges that its anti-money laundering program was ineffective. While details about what went wrong internally at Block are sparse, this article examines common failure patterns in ineffective programs and what your team can do to avoid them.
Why These Mistakes Keep Happening
An ineffective AML/CFT Framework doesn't fail suddenly; it deteriorates over time. Growth can outpace controls, and compliance may be seen as a cost center. Alerts accumulate while staffing remains unchanged. Each decision might seem reasonable in isolation, but the gaps become evident when regulators compare the paper program to actual practices.
The key word here is "ineffective." Simply having a program isn't enough. It must work at the scale and risk level of your business. Keep this in mind as you review the mistakes below.
Mistake 1: Building the Program for the Business You Were, Not the One You Are
Why it happens: Fast-growing firms often expand products, customer segments, and geographies faster than they update their risk assessments. The original controls may have been appropriate for the initial business, so they're not questioned.
The consequence: Controls designed for a smaller or lower-risk footprint can miss typologies that emerge with volume or in new channels. When enforcement arrives, the gap between your risk and your controls becomes the issue.
The fix: Tie your enterprise-wide risk assessment to your product launch process. No new product, customer type, or corridor should go live without a documented assessment of money laundering and Counter-Terrorist Financing exposure and a named control owner. Refresh the assessment regularly and during major growth or market changes.
Mistake 2: Treating Transaction Monitoring Rules as Set-and-Forget
Why it happens: Tuning is unglamorous, and untuned rules at least produce alerts, which gives a false sense of coverage. Changing rules requires validation work that busy teams often defer.
The consequence: Stale Transaction Monitoring Rules generate noise and miss real activity. Reviewers experience alert fatigue, and genuinely suspicious cases may be closed as quickly as false positives.
The fix: Conduct below-the-line and above-the-line testing regularly. Document why each threshold exists, who approved it, and when it was last validated. Map your rules to your risk assessment to show which typology each one is meant to catch, including Smurfing and Micro-Structuring patterns.
Mistake 3: Letting Technology Paper Over a Process Problem
Why it happens: Buying a platform can feel like solving the problem. Vendors promise coverage, and leadership seeks a visible fix.
The consequence: Software that's poorly configured, fed incomplete data, or left without ownership creates false confidence. RegTech can enhance detection, automate case triage, and reveal network links a human might miss. It can't make up for poor data lineage or unclear accountability.
The fix: Before any tooling decision, trace your data from onboarding to monitoring. Ensure that Customer Risk Ratings, product data, and counterparty details reach the monitoring engine. Assign a business owner for every automated control, and test outputs against known scenarios. If you can't explain why a model flagged or didn't flag a case, you can't defend it to an examiner.
Mistake 4: Starving the Investigation and Reporting Function
Why it happens: Investigations don't generate revenue, so staffing often lags behind alert volume. Backlogs become normal, and teams may close cases to meet service-level targets.
The consequence: Delayed or thin Suspicious Activity Reports indicate to regulators that your detection works on paper but your follow-through doesn't. A backlog is also a record of known unreviewed risk.
The fix: Measure alert aging and queue depth and report them to senior management, not just compliance. Set escalation triggers for backlog thresholds that force a resourcing decision. Ensure every FinCEN SAR (Form 111) narrative explains who, what, when, where, and why, and track Continuing Activity SAR cycles. Maintain SAR Confidentiality and train staff on Tipping Off risks.
Mistake 5: Weak Governance and No Real Challenge from the Top
Why it happens: Boards and executives often receive compliance reports full of activity metrics but little about residual risk. Without this information, there's nothing to challenge, and the BSA officer lacks leverage to push for budget or authority.
The consequence: When a program fails, regulators scrutinize who knew what. A compliance function that raised concerns without being heard, or never raised them clearly, leaves the institution exposed at the leadership level.
The fix: Provide your board with a concise, honest risk-and-resourcing report each quarter. Include open audit findings, backlog status, model validation results, and any known control gaps with remediation dates. Give the BSA officer direct access to the board and independence from revenue lines. Track audit findings to closure with named owners.
Prevention Checklist
Use this as a working review, not a one-time exercise:
- Your enterprise-wide risk assessment reflects your current products, customers, and geographies.
- New products and markets trigger a documented AML/CFT review before launch.
- Every Transaction Monitoring Rule maps to a risk and has a validation date.
- Monitoring data inputs are tested end to end, not assumed complete.
- Each automated control has a named owner and scenario-based testing.
- Alert and case backlogs are measured, aged, and reported upward.
- Suspicious Activity Report narratives are quality-checked, and continuing activity is tracked.
- Customer Due Diligence and Ongoing Due Diligence standards are applied consistently, with Periodic Review dates enforced.
- The board receives candid residual-risk reporting on a regular cycle.
- Audit and examination findings have owners, deadlines, and escalation paths.
Block's settlement is a reminder of the cost of an ineffective program. The lesson isn't to fear a number; it's to regularly test whether your controls would hold up if someone compared them to your actual risk.
