I am the Director of Event Processor Calibration at Bank of America, and for most of my career the most important number in American banking was 20.
I picked it. 20 points inside 13 months, and a human being would finally look at you.
The consent order calls my method "stakeholder judgment." I was the stakeholder. I still have the judgment.
Here is how it actually works.
Every day the bank's software flags transactions that might be money laundering: cash kept just under reporting limits, wires to risky places. Each flag is an alert.
Twice every weekday, the Event Processor reads the alerts. It does not investigate them. It gives each alert a weight between 0 and 20, pools the alerts by customer into an Event Group, and waits. If the group reaches 20 points before its oldest alert turns 13 months old, it becomes a case. If it doesn't, the old alerts retire.
Retirement is my favorite word in the system. It sounds like a cake and a watch.
Once someone reviews a case and decides it's suspicious, a 30-day clock starts to file a Suspicious Activity Report, the report that tells the government. An alert that never becomes a case never starts a clock. Other people race the clock. I keep it in the box.
The weights live in a file called EP_RiskWeights_MASTER_stakeholder_v31.xlsx. Hundreds of rows.
ATM Large Cash Deposit: 1 point. In April 2019 an internal Performance Analysis told me that factor turned into an actual SAR 56.75% of the time. I left it at 1. A 1 is modest. A 1 doesn't show off at parties.
High Intensity Drug Trafficking Area: 1 point. For weighting purposes, it is an area.
Some factors fire at the group level and count once, no matter how often they fire. A large aggregated wire alert can go off all year and contribute exactly 1 point. My kitchen smoke detector has run on the same principle since 2019. It chirps every 40 seconds. 1 point.
Dana Whitlock runs Investigations Capacity Planning. Her whiteboard has one number on it: the investigators we have. The Event Processor was born in 2010 partly because there were not enough investigators to work all of the alerts, and the threshold and Dana's whiteboard have been best friends ever since. When Dana erases a name, I go looking for a weight to lower.
Late 2021, Conference Room 22F, a deck titled Project Lighter Touch. I lowered 106 weights and raised 17. Net, minus 187 points. About 8,200 fewer cases to staff.
Under the estimate of SARs we would lose, I typed one word, "permissible," in 14-point Calibri. I did not explain how permissibility was determined. Explaining is a form of documentation, and documentation is a form of evidence.
Marcus Feld in Model Validation is the only person who has ever hurt me. In 2022 and early 2023 he tested the groups just under my line. Event Groups scoring 16 to 19 turned into SARs 38% to 45% of the time. The groups at 20 to 24, the ones we actually investigated, yielded 33% to 34%. My rejects were outperforming my picks.
Marcus called my weights "counterintuitive." He proposed a different threshold that would "uncover more SARs." It was declined over the "practical concern of pushing too many below-the-line event groups to cases." Dana's whiteboard does not have room for more SARs. I bought Marcus a succulent.
In 2023 another test found an 18% SAR yield below my line. Leadership had it done again. The second test blamed "investigator inexperience and biased sample selection" and came back "confident that EP is working as intended."
Two tests. One answer. The answer we already had.
My smoke detector has been reported by my wife in March 2020, June 2020 and about once a month since. Each report retires after 13 months. The group has never reached 20.
Now the part I am proudest of. The best analyst I ever worked with was the federal government.
Ike runs Promotion Intake on the 4th floor. A grand jury subpoena, a seizure warrant or a law-enforcement request skips the points entirely and "auto-promotes" straight to a case. Ike stamps each one AUTO-PROMOTE with a red rubber stamp and posts a party popper in a Slack channel called promotion-events. By 2023 nearly half of our investigations started that way, counting other banks' requests and the odd employee tip. The government works for free, never asks for headcount and shows up with a grand jury. Our customer risk ratings, in the order's words, "directly correlate[d] with the Bank receiving subpoenas." That is a very efficient way to be right.
Treasury later said we "effectively outsourced to third parties a substantial portion of its proactive detection." Outsourced is a strong word. I prefer partnered.
Money orders were my quietest product. Our systems "did not distinguish between types of negotiable instruments." Sequential numbers, round dollars, little stacks totaling between $2,900 and $3,000, which is precisely where you stand when $3,000 is the point where someone has to write down your ID. I did not weight them low. I did not weight them. Zero is the purest form of stakeholder judgment.
December 2023, the regulators engaged, and my line came down to 10 or 12 points. The window shrank from 13 months to 4. The lookback found about 8,900 SARs we should have filed, roughly $4 billion of activity, sitting below my 20 the whole time.
To work at the new line, the bank estimated 16,000 more investigations a month, 750 more staff and 800 consultants. The backlog peaked at nearly 200,000 cases. Dana now has three whiteboards. She has started talking to them.
Then the FinCEN consent order arrived, and on page 64 it reviewed my work. It said the Bank had "likely saved hundreds of millions of dollars in compliance-related expenditures."
Nobody at this bank has ever written a better sentence about me. I had it framed. It hangs over my monitor, beside the counter that tracks my personal KPI, Cases Not Opened.
The order also defines willful as "reckless disregard or willful blindness." I have never been blind. I can see 19 perfectly.
October, 22F, the earnings call on the wall screen. The penalty was $1.2 billion. FinCEN credited the $750 million we paid the OCC, so the cash that went to FinCEN was $450 million. In the same quarter we spent $6.0 billion buying back our own stock, 5 times the penalty. I don't run buybacks. I respect any number that clears its threshold.
Our spokesperson said, "We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime." By the bank's own estimate, it needed 750 more of them to read what my 20 had been keeping quiet.
Our CEO said, "we've resolved the government discussion in the AML area." The OCC, the day before, wrote that "the Bank's BSA/AML program remains deficient."
Resolved is about the discussion. Deficient is about the program. Different Event Groups. They never pool.
On Friday I was named Head of Threshold Strategy for the remediation. The FinCEN order asks the lookback to consider "super intelligence models." Someone has to tell the super intelligence how many points a thing needs before it may notice.
They asked how I would choose the number.
I said the same way I chose the last one.
They wrote it down as experience.
At home, the smoke detector is still chirping. 1 point, group level, every 40 seconds since 2019.
I have never once smelled smoke.