The Securities and Exchange Commission has fined Merrill Lynch, Pierce, Fenner & Smith Incorporated $7.5 million for willfully violating federal anti-money laundering rules. The penalty, announced Monday, stems from the firm's failure to file hundreds of suspicious activity reports (SARs) over a four-and-a-half-year period. This marks the third time since 2017 that the Bank of America brokerage unit has faced SEC enforcement for SAR-related deficiencies.
According to the SEC's order, Merrill Lynch violated Section 17(a) of the Securities Exchange Act of 1934 and Rule 17a-8, which require broker-dealers to comply with Bank Secrecy Act reporting obligations. The firm neither admitted nor denied the findings but accepted a censure, a cease-and-desist order, and the civil penalty.
Software Flaw Created Blind Spots
The SEC investigation focused on the period from April 8, 2020, through September 10, 2024. During this time, Merrill delegated most of its Bank Secrecy Act compliance to Bank of America's enterprise-wide anti-money laundering program. That program used a system called Event Processor to aggregate alerts into Event Groups and assign each a numeric risk score.
The critical flaw: Merrill only investigated Event Groups with risk scores of 20 or higher for potential SAR filings. Internal analyses dating back to April 2020 showed that some groups below that threshold would have resulted in SARs if reviewed. Despite this knowledge, the firm did not lower the threshold until December 2023—more than three years later.
The SEC noted that the overlooked transactions involved hundreds of millions of dollars. They included transfers with no apparent lawful business purpose, large round-dollar wire transfers, cash transactions structured to avoid reporting thresholds, transfers linked to high-risk geographic locations, transactions tied to criminal activity, and activity in accounts previously subject to SAR reviews.
Pattern of Regulatory Failures
This is not Merrill's first SAR-related penalty. In December 2017, the firm settled similar SEC charges. In July 2023, it paid a combined $12 million penalty to the SEC and the Financial Industry Regulatory Authority for failing to apply the correct reporting threshold for over a decade.
In the latest case, the SEC acknowledged Merrill's cooperation and remedial steps. After lowering the Event Processor threshold in December 2023, Merrill and Bank of America conducted a retrospective review of previously uninvestigated Event Groups and filed numerous SARs. The firm must pay the $7.5 million civil penalty within 14 days of the June 29 order.
The enforcement action comes amid broader industry scrutiny of anti-money laundering compliance. For context, Merrill has also been active in recruiting, as seen in recent moves like Merrill Lynch Recruits UBS Veteran with $460M; Wells Fargo Adds $825M in West Coast Hires and Baird Adds $508M RBC Team; Merrill Lynch Recruits $560M in Father-Son Advisors. However, the SAR failures highlight ongoing compliance challenges at the wirehouse.
The SEC's order serves as a reminder that even large firms with sophisticated systems can face significant penalties for systemic oversight gaps. Advisors and compliance professionals should note that the regulator continues to prioritize anti-money laundering enforcement, as evidenced by this third action against Merrill.
