Merrill Lynch SEC fine: BofA (BAC) unit fined $7.5M

The Securities and Exchange Commission fined Merrill Lynch $7.5 million on Monday, saying the Bank of America (BAC) brokerage unit failed to file required suspicious-activity reports for more than four years. Small as the fine is beside Bank of America’s balance sheet, the case puts a price on a surveillance failure inside one of Wall Street’s largest wealth platforms.

The failures ran from April 2020 to September 2024, according to the settlement details carried by Reuters and a secondary account of the action. Merrill screened transactions and customer behaviour through an internal risk-score threshold of 20, the SEC said, leaving some events without the reports regulators said were required.

Suspicious-activity reports are one of the basic alerts banks and brokerages use for money laundering and other illicit-finance risks. The Merrill case was not about a trading call, a bad market forecast or a customer complaint. It was about whether the firm’s monitoring system sent enough cases to compliance staff when its own screens spotted activity that regulators believed should have been reported.

That makes the action more than a narrow compliance defect. Large brokerages rely on automated surveillance to sift huge volumes of client activity. If those models miss conduct the SEC says should have triggered a filing, the weakness becomes a test of how the firm polices illicit-finance risk at scale.

For Bank of America, the $7.5 million fine is not an earnings event. The public action against Merrill’s reporting controls is more awkward. Big wealth platforms sell scale and operational discipline as strengths; a poorly calibrated score or review queue can carry the same weakness across a wide client base before anyone catches it.

Why the threshold matters

The number sounds technical. It is not.

Merrill’s score of 20 gives the case its wider bite. Thresholds are routine inside surveillance systems, and most clients never see them. But once a regulator says the line was set or applied too loosely, the discussion moves from software tuning to whether the firm met its reporting duty.

Bank of America said the firm already had strong controls and kept reviewing them. In a statement reported by Reuters, the bank said it “maintains rigorous anti-money laundering practices” and “continually reviews its anti-money laundering systems to detect and report suspicious activity.”

“maintains rigorous anti-money laundering practices, and continually reviews its anti-money laundering systems to detect and report suspicious activity”

Bank of America, via Reuters

That is the tension regulators tend to test.

Firms point to policies, software and review teams; regulators judge the output. If suspicious-activity reports were missed from April 2020 through September 2024, the SEC is saying the system did not clear the bar, whatever the written framework looked like inside the brokerage.

The read-through for big-bank wealth managers is practical rather than dramatic. Anti-money-laundering enforcement still reaches deep into operational settings that can look secondary to trading, lending or client growth. Regulators care about who reviews an alert, how high a score must be before a human sees it and how quickly a case is escalated once it enters the queue.

For Merrill, the penalty closes one case and leaves a warning for the rest of the industry. Brokerage surveillance is not a quiet support function when a control gap runs for several years. The SEC action shows how an internal monitoring choice can become headline regulatory risk, even when the debate starts with a number as technical as a score of 20.