Merrill Lynch, Pierce, Fenner & Smith Incorporated has agreed to pay a $7.5 million civil penalty to the Securities and Exchange Commission. The charge: it failed to file a large number of Suspicious Activity Reports between April 2020 and September 2024.
According to the SEC’s settled order, To meet its own SAR filing duties, Merrill relied on the enterprise-wide Bank Secrecy Act and anti-money laundering program of its parent, Bank of America Corporation.
That program grouped potentially suspicious transactions into event groups and gave each a risk score. Only the groups that scored above a set threshold were investigated for a possible SAR filing. Everything below the line went unexamined.
The record shows the firm had reason to know that was a problem. The SEC found that internal analyses going back to April 2020 indicated many of the lower-scoring groups would probably have led to SAR filings if anyone had looked at them. No one did. Over the next four years, Merrill missed numerous reportable instances of suspicious activity.
The legal finding
The regulator concluded that Merrill violated Section 17(a) of the Securities Exchange Act of 1934 and Rule 17a-8. Together, those provisions require broker-dealers to maintain effective anti-money laundering programs and to meet their SAR filing obligations.
Merrill neither admitted nor denied the findings. It agreed to a cease-and-desist order and a censure, along with the $7.5 million payment.
The case turns on a point of accountability. A firm that relies on a parent company’s monitoring system still owns its own filing duty, and the settlement shows regulators expect broker-dealers to test whether alert thresholds actually catch what they are meant to catch. That means validating the thresholds, reviewing the models on a regular schedule, and making sure risk-scoring rules are not screening out activity that should be reported.
