SEC Sanctions Merrill Lynch $7.5 Million Over SAR Filing Failures

The SEC has instituted settled administrative and cease-and-desist proceedings against Merrill Lynch, Pierce, Fenner & Smith Incorporated for failing to file numerous Suspicious Activity Reports with FinCEN between April 8, 2020 and September 10, 2024, in violation of Exchange Act Section 17(a) and Rule 17a-8. Merrill relied on parent Bank of America's enterprise-wide BSA/AML transaction monitoring system, "Event Processor," which only promoted alerts scoring 20 points or higher for investigation — despite internal sampling analyses showing, as early as April 2020, that many sub-threshold Event Groups carried SAR Yields comparable to or higher than those above the cutoff. The threshold wasn't lowered until December 2023, during which time Merrill failed to file SARs on hundreds of millions of dollars in suspicious transactions, including transfers with no apparent lawful purpose, large round-dollar transfers, high-risk jurisdiction activity, structured cash transactions, and activity in previously flagged accounts. Without admitting or denying the findings, Merrill agreed to a cease-and-desist order, censure, and a $7.5 million civil penalty. The SEC credited Merrill's cooperation and remedial steps, including lowering the detection threshold, conducting a retrospective review that generated additional SAR filings, and Bank of America's engagement of a compliance consultant for a full BSA/AML assessment. Notably, this marks Merrill's third SEC enforcement action for SAR-filing deficiencies (following settlements in 2017 and 2023) and follows a related December 2024 OCC consent order against Bank of America, N.A. for BSA and sanctions compliance program deficiencies.