Thresholds should be one important detector of further scrutiny before processing a customer’s transaction request. Mr. Clark in this post picked up the application of thresholds in the Consent Order brought down on Bank of America by the US Office of the Comptroller of the Currency (OCC).
As he states, you need to set the thresholds where risk exists. If not, fraud can continue unabated with many victims resulting from this major omission.
AML/CTF & Fraud | Making sure the AI fighting financial crime actually works
This month Bank of America was hit with more than US$1.2 billion in penalties across FinCEN, the OCC and OFAC, including the largest penalty in OCC history. The dollar figure will grab the headlines, but what piqued my interest was on page 31 of the Consent Order.
BofA ran a proprietary “Dynamic Risk Rating” model that combined weighted risk factors into a score, which then set the level of customer due diligence, periodic review and ongoing monitoring for each customer. That kind of risk-based approach isn’t controversial. The problem is that, over several years, BofA’s own testing kept flagging issues with the thresholds and weightings. Customers sitting just below the threshold were producing relatively high SAR rates. When the bank did lower the thresholds, it estimated the change would create about 16,000 extra investigations a month and require around 750 more staff.
For me, that last sentence sums up the whole problem. The threshold wasn’t set where the risk was. It was set where the investigations team could keep up.
The model (probably) worked. Without getting under the hood I can’t say for sure it was well designed, but if it wasn’t a decent predictor of customer risk, a threshold change is unlikely to have had such a big impact on SARs.
The testing definitely worked. Validation found the problem and correctly pinned it on the threshold setting.
The human decision-makers fumbled.
It’s a very expensive lesson for BofA, but it’s a good reminder for the rest of us. Smart model design and a robust performance monitoring framework matter, but without strong human accountability and ownership, they’re just a .docx nobody reads.
Head of Financial Crime Risk
Love this insight! Agree that operational impost is never a justifiable or defensible driver for risk thresholds.
AML/CTF & Fraud | Making sure the AI fighting financial crime actually works
Susannah Hanton It still could have been a great outcome if someone had looked at the estimated 16,000 investigations and thought “how can we conduct more efficient investigations?” or “how can we prevent potentially-criminal behaviour in the first place?” instead of making a decision based on a historical AHT. Of course, that’s easier said than done, but difficult decisions are part of accountability and ownership.
