OCC Penalties and Your AML/CFT Framework: A Compliance Engineer's Diagnostic

Scope: Diagnosing and Fixing Compliance Gaps

This guide helps you identify and fix the AML/CFT framework and BSA compliance issues that can lead to major enforcement actions. It focuses on the control gaps that result in significant civil money penalties, using the OCC's $350 million penalty against American Express National Bank as a reference for what regulators scrutinize most closely.

You'll find actionable checkpoints for your transaction monitoring, suspicious activity reporting, and customer due diligence systems. This isn't about American Express specifically, it's about the control architecture every bank must maintain to avoid similar outcomes.

Key Concepts and Definitions

BSA Compliance Program: Your institution's written framework for detecting and reporting suspicious activity, maintaining required records, and filing Currency Transaction Reports. Required under 31 U.S.C. § 5318(h) and implemented through 12 CFR Part 21.

AML/CFT Framework: The operational implementation of your BSA program, including transaction monitoring rules, name screening protocols, and customer risk rating methodologies.

Deficiency vs. Violation: A deficiency is a gap in your control environment (missing procedures, inadequate testing, unresolved alerts). A violation is a missed filing deadline, an unreported transaction, or a failure to freeze assets. Penalties can stem from either.

Civil Money Penalty: A financial sanction imposed by a regulator without criminal prosecution. The OCC can assess penalties up to the greater of $1 million per day or the gain derived from the violation.

Requirements Breakdown

BSA Program Requirements (12 CFR 21.21)

Your written program must include:

1. System of internal controls: Documented procedures for each BSA requirement, not just policies.
2. Independent testing: Audit or third-party review conducted every 12-18 months.
3. Designated BSA Officer: Individual with authority and direct access to the board.
4. Training program: Role-specific education for frontline staff, investigators, and senior management.
5. Customer due diligence procedures: Risk-based identification and verification protocols.

Transaction Monitoring Rules

You're required to identify patterns indicative of money laundering, structuring, and terrorist financing. This means:

• Scenario coverage: Your rules must address the typologies relevant to your customer base and product mix.
• Tuning discipline: Document threshold changes, suppression logic, and false positive rates quarterly.
• Alert disposition: Investigate and document every alert within defined SLAs; "closed, no SAR" requires a written rationale.
• Scenario testing: Validate that rules fire correctly using synthetic transactions before deployment.

Suspicious Activity Reporting

File a FinCEN SAR (Form 111) within 30 calendar days of initial detection when:

• You know, suspect, or have reason to suspect a transaction involves funds from illegal activity.
• The transaction is designed to evade BSA requirements.
• The transaction has no business or lawful purpose.
• The transaction involves $5,000 or more (or any amount for insider abuse or computer intrusion).

Critical: "Initial detection" is when your institution first identifies facts sufficient to warrant investigation, not when you complete the investigation.

Implementation Guidance

Diagnostic Checkpoints for Your Control Environment

Run these checks quarterly to identify the deficiencies regulators target:

Alert Management:

• Calculate your aged alert inventory (alerts open >90 days). If it exceeds 5% of total alerts, you have a backlog problem.
• Review your "closed, no SAR" rationale. If more than 15% use generic language ("insufficient information," "customer explained"), your investigators aren't documenting adequately.
• Check alert-to-SAR conversion rates by scenario. Rates below 1% or above 40% signal tuning problems.

Customer Due Diligence:

• Audit a sample of high-risk accounts opened in the past 12 months. Verify that beneficial owner identification was completed at onboarding, not retroactively.
• Review your periodic review queue. Accounts overdue for refresh by more than 60 days indicate resource or workflow issues.
• Test your customer risk rating model against actual SAR filings. If you've filed SARs on customers rated low-risk, your model isn't predictive.

Technology Controls:

• Document your transaction monitoring system's data sources. If you're missing data feeds (wire details, ACH origination, card authorization declines), you have blind spots.
• Verify that name screening runs against the complete OFAC Specially Designated Nationals list, not a filtered subset. Test with known matches quarterly.
• Check your system's audit trail. You must be able to reconstruct who reviewed an alert, when, and what data they saw.

Building Defensible Documentation

When examiners arrive, they'll request:

1. Board reporting packages: What AML/CFT metrics you presented to directors and when.
2. Independent testing reports: Findings, management responses, and remediation evidence.
3. Training records: Completion rates, content updates, and role-specific curricula.
4. Alert investigation files: Complete narratives, not just system dispositions.
5. Scenario validation results: Proof that your monitoring rules detect the risks you've identified.

Your documentation must show you identified deficiencies yourself and took corrective action. "We found this gap in Q2 testing and implemented controls in Q3" is defensible. "We weren't aware until the exam" is not.

Common Pitfalls

Treating alerts as production quotas: If your investigators close a fixed number of alerts per day regardless of complexity, you're optimizing for throughput instead of quality. Regulators review the substance of your investigations, not the count.

Deferring system upgrades: Running transaction monitoring software more than two major versions behind the current release creates technical debt and limits your ability to implement new scenarios. Budget for upgrades as a recurring operational expense.

Siloed data: Your fraud system, your sanctions screening platform, and your transaction monitoring tool must share data. If a customer triggers a fraud block, that's relevant to AML risk assessment.

Generic risk assessments: Copying another institution's risk assessment or using vendor templates without customization won't satisfy examiners. Your assessment must reflect your actual products, customer segments, and geographic footprint.

Underestimating staffing: If your alert investigators are also handling CTR quality control, periodic reviews, and subpoena responses, something will slip. Calculate workload based on actual hours required per task type.

Quick Reference Table

Control Area	Regulatory Requirement	Red Flag Indicator	Remediation Priority
Transaction Monitoring	Detect patterns of suspicious activity (31 CFR 1020.210)	Alert backlog >90 days exceeds 5%	HIGH, Increase investigator capacity or tune scenarios
Suspicious Activity Reporting	File within 30 days of detection (31 CFR 1020.320)	Late filings in past 12 months	CRITICAL, Implement workflow alerts at day 20
Customer Due Diligence	Identify beneficial owners at account opening (31 CFR 1010.230)	Retroactive BO collection >10% of new accounts	HIGH, Retrain account opening staff
Independent Testing	Conduct every 12-18 months (12 CFR 21.21)	Last test completed >18 months ago	CRITICAL, Engage auditor immediately
Name Screening	Screen against OFAC SDN list (31 CFR 501.603)	False negative in testing	CRITICAL, Validate data feed and matching logic
Recordkeeping	Retain BSA records for 5 years (31 CFR 1010.430)	Incomplete alert investigation files	MEDIUM, Implement file completeness checklist
Board Reporting	Report AML/CFT Framework effectiveness to board (12 CFR 21.21)	No metrics in board packages	HIGH, Develop quarterly dashboard
Training	Provide ongoing, role-specific training (12 CFR 21.21)	Completion rate <95%	MEDIUM, Automate enrollment and tracking

Note: Priority levels assume no current enforcement action. If you're under consent order or have received an MRA (Matter Requiring Attention), treat all items as CRITICAL.

Bookmark this guide and review it before your next independent test or regulatory exam. The control gaps that led to a $350 million penalty aren't exotic, they're the result of deferred maintenance, under-resourced teams, and documentation shortcuts that accumulate over time.