The Securities and Exchange Commission has imposed a $7.5 million civil penalty on Merrill Lynch for failing to file suspicious activity reports, the second time in three years the firm has been disciplined for a nearly identical compliance lapse. The fine, announced June 29, covers violations from April 2020 through September 2024, a four-and-a-half-year period during which the brokerage allegedly did not flag client transactions that should have been reported to authorities.
Suspicious Activity Reports, or SARs, serve as a cornerstone of anti-money laundering enforcement. Financial institutions are legally required to file them whenever they detect transactions that could involve fraud, money laundering, terrorist financing, or other illicit behavior. In Merrill’s case, the breakdown stemmed from its reliance on Bank of America’s transaction monitoring software.
That system used a risk-scoring approach to decide which client activities warranted closer scrutiny. Any activity that scored below a preset threshold was simply ignored and never flagged for potential reporting.
The SEC’s action marks the second time in three years that the regulator has found Merrill on the wrong side of the same reporting requirement. The agency is signaling that repeated failures in basic anti-money laundering infrastructure will carry a financial penalty significant enough to command attention at the highest levels of a firm’s leadership. For the broader financial sector, the case sends a clear message: relying on a parent company’s monitoring system does not relieve a firm of its own reporting obligations.
Compliance officers at major brokerages now face increased risk if their software thresholds are set too high, effectively raising the cost of such miscalculations.
Regulatory Structure and Recent Challenges
The Financial Industry Regulatory Authority, commonly known as FINRA, is a private self-regulatory organization that oversees thousands of brokerage firms and hundreds of thousands of registered securities representatives across the United States. FINRA was created in 2007 through a merger of the regulatory and enforcement arms of the National Association of Securities Dealers and the New York Stock Exchange.
The consolidation was approved by the Securities and Exchange Commission, which remains the ultimate federal regulator of the securities industry. FINRA’s authority has faced legal challenges in recent years. A broker-dealer argued after a 2019 enforcement action that the regulator is unconstitutional.
The Supreme Court declined to hear that case in 2025, effectively upholding FINRA’s power to discipline firms and individuals. That same year, a member of Congress introduced legislation that would transfer FINRA’s rulemaking, examination, and enforcement authority to the SEC.
A hearing on the bill was held in early 2026.
Lessons for Firms and Investors
The SEC’s penalty against Merrill Lynch demonstrates that a firm’s anti-money laundering obligations are not satisfied simply because a parent company’s monitoring system is in place. FINRA separately requires its member firms to maintain adequate supervisory procedures. Repeated failures in this basic area of compliance have drawn escalating attention from regulators. For investors and the broader public, the case underscores that the overlapping layers of financial oversight do not eliminate individual firm responsibility.
Even with multiple regulatory bodies supervising the securities industry, each firm remains independently accountable for building and maintaining the systems needed to spot suspicious activity. The $7.5 million fine serves as a concrete reminder that compliance shortcuts or over-reliance on shared infrastructure can lead to significant penalties, especially when the same failure recurs within a few years.
