The SEC yesterday issued a cease and desist order, charging Merrill Lynch and its parent company, BAC North America Holding Co. (BACNAH), a subsidiary of Bank of America, for failing to file hundreds of Suspicious Activity Reports (SARs) over the course of a decade.

The US Financial Industry Regulatory Authority (FINRA) filed its own order, referencing FINRA Rule 3310, which requires broker-dealers to “develop and implement a written anti-money-laundering program reasonably designed to achieve and monitor the member’s compliance with the requirements of the Bank Secrecy Act.”

Merrill must pay a total civil money penalty in the amount of $12m ($6m to each agency) within 14 days of the entry of the orders.

Timing and filing of SARs

Specifically, the SEC alleges that from January 2009 to November 2019, Merrill failed to file certain SARs in violation of the broker-dealer books and records provisions of Exchange Act Section 17(a) and Rule 17a-8.

Merrill, as a registered broker-dealer, was required to file SARs on transactions conducted or attempted by, at, or through it involving or aggregating to at least $5,000 that it knew, suspected, or had reason to suspect, among other things, involved the use of Merrill to facilitate criminal activity.

For broker-dealers such as Merrill, the threshold amount is $5,000, regardless of whether the suspicious activity involves an insider at the broker-dealer or no-suspect criminal activity.

BACNAH assumed responsibility for creating and implementing Merrill’s SAR policies and procedures and filing Merrill’s SARs. During the relevant period, however, BACNAH’s Fraud Investigations Group used a $25,000 threshold with respect to transactions or attempted transactions suspected of using Merrill to facilitate criminal activity where there was no substantial basis for identifying a suspect responsible for the suspected criminal activity.

For broker-dealers such as Merrill, the threshold amount is $5,000, regardless of whether the suspicious activity involves an insider at the broker-dealer or no-suspect criminal activity.

This “no-suspect criminal activity” concerned Merrill customers who were victims of unauthorized debit card withdrawals, forged or altered checks, account intrusions, identity theft, and/or phone or internet scams. The oversight led BACNAH failing to file hundreds of SARs for Merrill on such activity during that lengthy timeframe.

Fraud Investigations Group

In about September 2019, an employee recognized that the Fraud Investigations Group was improperly using the $25,000 threshold.

In determining to accept the cease and desist order as requested by Merrill and in considering a proper penalty, the SEC considered BACNAH’s and Merrill’s remedial acts and cooperation. This included their efforts to update policies, procedures, and automated surveillance systems and training its Fraud Investigations Group personnel responsible for filing SARs.

Merrill also reported the issue to the SEC’s staff and other relevant regulators and conducted a look-back to 2014 (the earliest date for which Merrill retained records) on its SARs for no-suspect criminal activity that met the proper $5,000 threshold.

And BACNAH and Merrill voluntarily conducted and shared results of their internal investigation that they conducted after discovering the wrong threshold had been used.