SEC fines Merrill Lynch $7.5 million for alleged AML monitoring gaps tied to Bank of America program

The U.S. Securities and Exchange Commission has imposed a $7.5 million penalty on Merrill Lynch, the brokerage arm of Bank of America, over alleged shortcomings in anti-money-laundering monitoring and reporting, according to a report published by American Banker.

Merrill uses a Bank of America software program to help monitor transactions and identify activity that may require suspicious activity reporting, the report said. The SEC’s complaint, as summarized in the coverage, concluded that the monitoring and reporting performance of that program fell short for years.

Anti-money-laundering, or AML, is the set of laws and internal controls banks and broker-dealers use to detect and report potentially illicit financial activity. For firms that hold and move customer assets, regulators focus not only on whether alerts are generated, but also on whether compliance teams can rely on the quality of the monitoring outputs and escalate issues appropriately.

In the SEC matter described in the article, regulators faulted the effectiveness of the system used by Merrill to oversee potentially suspicious activity, suggesting that the program did not function as intended as part of a broader compliance framework.

Bank of America, whose brokerage subsidiary is under the Merrill Lynch name, has built much of its internal compliance technology around centralized tools and shared processes across businesses. When a unit uses enterprise-wide systems, regulators often evaluate whether those tools meet the specific monitoring and escalation needs of each regulated entity.

The $7.5 million penalty is directed at Merrill Lynch, but it also highlights how brokerage and banking compliance expectations are increasingly tied to the performance of automated monitoring tools. Software-based transaction screening and alerting has become a central element of AML programs, and regulators have repeatedly scrutinized whether the technology and governance around it produce reliable results.

The company did not provide additional details in the reported account beyond what was attributed to the SEC’s allegations. The coverage did not spell out the precise technical or procedural failures, the specific years involved, or the remediation steps Merrill and Bank of America took after regulators raised the issues.

Going forward, the key question is how regulators will evaluate fixes and ongoing performance for monitoring systems that are shared across corporate units. Investors and compliance observers will likely watch for updates to controls, reporting procedures, and how effectively enterprise monitoring tools can be tuned and validated to meet regulatory thresholds.