The SEC fined Bank of America’s (BAC) Merrill Lynch unit $7.5 million Monday for failing to file suspicious activity reports over a four-year span, exposing a software-driven blind spot in the firm’s anti-money laundering controls.
For BAC shareholders and sector watchers, the penalty underscores rising regulatory scrutiny of broker-dealer compliance infrastructure at a time when AML enforcement actions across major financial institutions have been accelerating.
Key Takeaways
- SEC fines Merrill Lynch $7.5 million over missed SAR filings.
- Flawed risk-score threshold in monitoring software caused gap.
- Merrill cooperated and has since lowered its alert threshold.
Market Reaction & Context
The $7.5 million fine is modest relative to Bank of America’s scale – the Charlotte, North Carolina-based lender reported roughly $27 billion in net income for full-year 2025 – but the reputational dimension matters more than the dollar amount for compliance-focused investors. 1
Peer broker-dealers including Morgan Stanley and Goldman Sachs have faced their own AML-related regulatory actions in recent years, making robust suspicious activity reporting infrastructure a recurring theme in financial sector risk assessments.
How the Compliance Gap Occurred
The SEC said the violation stemmed from Merrill’s reliance on Bank of America’s transaction monitoring software, which is used to satisfy obligations under the federal Bank Secrecy Act – the statute requiring broker-dealers to file SARs with the U.S. Treasury Department’s Financial Crimes Enforcement Network (FinCEN). 2
According to the regulator, the software bundled potentially suspicious transactions into “event groups” and assigned each a numerical “risk score.” Merrill’s internal policy only triggered full SAR investigations for event groups scoring 20 or above – even though the firm’s own internal analyses showed that some lower-scoring groups would have generated SAR filings had they been reviewed. 3
The four-year window of the violations – April 2020 through September 2024 – spanned pandemic-era trading surges and elevated retail participation in markets, periods historically associated with heightened money-laundering risk.
Regulatory Finding & Bank Response
Merrill neither admitted nor denied wrongdoing in accepting the civil penalty, a standard feature of SEC settlements. The regulator credited the firm for cooperating with the probe and for subsequently filing numerous SARs after lowering its internal review threshold.
“Bank of America maintains rigorous anti-money laundering practices, and continually reviews its anti-money laundering systems to detect and report suspicious activity,” the bank said in a statement. 2
The SEC’s action signals that over-reliance on algorithmic scoring – without periodic validation against real-world outcomes – can create compliance gaps even when firms believe their systems are functioning correctly.
Outlook
The enforcement action arrives as the SEC and FinCEN have both signaled heightened focus on broker-dealer AML frameworks, particularly as digital asset activity and complex structured products increase the volume and velocity of potentially suspicious transactions. The case reinforces that software configuration choices, not just policies on paper, will face regulatory scrutiny. 1
For macro and sector investors monitoring regulatory risk across the large-cap bank universe, the Merrill settlement is a data point suggesting that AML compliance costs – remediation, enhanced monitoring, and potential further fines – could weigh incrementally on operating expenses across the broker-dealer sector in coming quarters.
Conclusion
The SEC’s $7.5 million fine against Merrill Lynch is less significant as a financial hit to Bank of America than as a marker of where regulators are directing scrutiny: the internal algorithmic calibration of compliance systems. Firms across the broker-dealer landscape will likely review their own SAR thresholds in the wake of this settlement.
Not investment advice. For informational purposes only.
References
1Stempel, Jonathan (June 29, 2026). “US SEC fines BofA’s Merrill Lynch $7.5 million for not flagging enough suspicious activity”. Reuters. Retrieved June 29, 2026.
2Stempel, Jonathan (June 29, 2026). “US SEC fines BofA’s Merrill Lynch $7.5 million for not flagging enough suspicious activity”. KFGO / Thomson Reuters. Retrieved June 29, 2026.
3“US SEC fines BofA’s Merrill Lynch $7.5 million over suspicious activity reports”. MarketScreener. Retrieved June 29, 2026.