The Hidden Price of AML Failures: The $25,000 SAR Threshold Behind a $500,000 FINRA Fine
Updated October 2026. First published April 2025. The first version described an invented FINRA case and presented named firms as Loffa clients. This version replaces those examples with public cases.
On August 22, 2025, FINRA accepted a settlement from U.S. Bancorp Investments, Inc. (USBI), a broker-dealer in Saint Paul, Minnesota, with more than 2,350 registered representatives in more than 1,620 branch offices. USBI agreed to a censure and a $500,000 fine without admitting or denying the findings. The case turns on one number. From April 2020 to August 2023, the team that filed USBI's suspicious activity reports (SARs) used a $25,000 threshold for a category of cases where the broker-dealer rule sets $5,000. Forty-two SARs weren't filed on time.
Nobody ignored an alert, and no rogue employee appears in the order. The filing team applied the bank's threshold to brokerage cases with no identified suspect, and that was the whole failure. USBI found the error itself, after reading a FINRA case against another firm, and filed the missing reports about two weeks later. You can learn the same lesson the same way, from someone else's AWC.
Two Rules, Two Thresholds
A broker-dealer files a SAR under 31 CFR 1023.320(a)(2) when a transaction conducted or attempted by, at, or through it involves or aggregates at least $5,000, and the firm knows, suspects, or has reason to suspect one of four things: the funds come from illegal activity, the transaction is designed to evade the Bank Secrecy Act, it has no business or apparent lawful purpose, or it uses the broker-dealer to facilitate criminal activity. The $5,000 threshold doesn't depend on whether you can name a suspect.
National banks file under the OCC's rule, 12 CFR 21.11(c), which sets different lines for suspected crimes depending on who may have committed them.
| Suspicious activity | Broker-dealer | National bank |
|---|---|---|
| Suspected crime involving an insider | $5,000 | Any amount |
| Suspected crime, suspect identified | $5,000 | $5,000 |
| Suspected crime, no suspect identified | $5,000 | $25,000 |
| Possible money laundering, evasion of the Bank Secrecy Act, or no apparent lawful purpose | $5,000 | $5,000 |
The gap is the third row: suspected crimes where nobody can say who did it. Under the bank rule, a $12,000 unauthorized transfer with no suspect is under the line. In a brokerage account, the same transfer needs a SAR.
The broker-dealer rule handles no-suspect cases through the deadline. A SAR is due within 30 calendar days of initial detection. If no suspect has been identified, the firm may take another 30 days to find one, but it can't delay the report past 60 days.
How the Bank's Number Reached the Broker-Dealer
USBI's parent is a bank holding company with a centralized, enterprise-wide process for AML compliance and SAR filing that covers its subsidiaries, including USBI and its banking affiliate. Until July 2018, the enterprise's financial crimes compliance group investigated suspicious activity and filed SARs for USBI at any dollar amount. In July 2018, filing for certain SARs moved to a fraud SAR filing group inside the enterprise. From at least April 2020 to August 2023, that group applied the bank's $25,000 threshold to USBI cases with no identified suspect.
So nobody rewrote the broker-dealer's rule. A slice of the work moved to a different team, and that team applied the bank threshold to brokerage accounts. The reports that went unfiled covered account intrusions, identity theft, and internet scams.
Merrill Lynch Made the Same Mistake for Ten Years
The AWC says USBI spotted the problem in August 2023 "after reviewing a similar FINRA enforcement action against a different firm." It doesn't name the firm. A month earlier, on July 11, 2023, FINRA and the SEC each fined Merrill Lynch $6 million for the same error (FINRA AWC, SEC order).
After Bank of America Corporation acquired Merrill in January 2009, a fraud investigations group at Merrill's parent took over investigating suspected crimes at Merrill and filing its SARs. That group already filed for the affiliated national banks under the bank thresholds, and it applied the same $25,000 line to no-suspect cases in Merrill accounts. Merrill's written SAR procedures mentioned only the bank threshold. The SEC charged Merrill under Exchange Act Section 17(a) and Rule 17a-8, which require broker-dealers to comply with FinCEN's reporting and recordkeeping rules, and FINRA charged it under Rule 3310(a). The examples in the AWC are ordinary fraud: a $24,000 transfer in January 2014 that the customer hadn't authorized, to his account at another institution that had been compromised, three forged checks totaling $17,585 in August 2014, and a $15,000 unauthorized online payment in July 2017. An employee noticed the error in about September 2019.
| USBI (2025) | Merrill Lynch (2023) | |
|---|---|---|
| Wrong threshold in use | April 2020 to August 2023 | January 2009 to November 2019 |
| SARs not filed on time | 42 | About 1,500 |
| How the firm found it | Read another firm's enforcement action | An employee noticed, about September 2019 |
| Look-back | Six years; 42 SARs filed | Back to 2014, the earliest records it kept; 865 SARs filed |
| Penalty | $500,000 FINRA fine | $6 million FINRA fine and $6 million SEC penalty |
Where the Price Hides
The fine is the number in the headline. The two orders show what else the mistake cost.
The look-back comes first. Each firm had to review years of past fraud cases and file late. Merrill's review could only reach 2014, the earliest year it still had records for, and it filed 865 SARs from it. The AWC puts the total Merrill missed at about 1,500.
Time matters too. USBI used the wrong number for more than three years, and Merrill for more than ten. The penalties differ by a factor of 24, though Merrill is also far bigger, with more than 29,000 registered representatives. FINRA's sanctions section for USBI lists what it weighed: the firm found the issue itself, started its review before any regulator stepped in, shared the results with FINRA, amended its procedures, trained the people who file, and filed the 42 SARs about two weeks after it found the problem.
Then there's the record. Each AWC becomes part of the firm's permanent disciplinary record and may be considered in any future action. Merrill's 2023 AWC opens by listing its earlier AML cases from 2011, 2014, and 2017, including $26 million in combined FINRA and SEC penalties in 2017.
Some of the cost lands outside the firm. The unfiled reports described the firms' own customers being defrauded, and FinCEN got them late, some by years.
What to Check
- Find the number your filers actually use. If a bank parent's team investigates fraud and files SARs for your broker-dealer, read that team's procedures along with your own AML program. Confirm they state $5,000 for brokerage accounts in every category, including fraud with no identifiable suspect. Merrill's written procedures named only the bank threshold.
- Check the systems as well as the documents. Merrill had to correct an automated surveillance system along with its written procedures. Case-management rules that close cases under a dollar amount carry a threshold too. Our post on the data behind AML surveillance covers the same kind of gap on the monitoring side.
- Test the range. Pull last year's closed fraud cases in brokerage accounts between $5,000 and $25,000 that ended without a SAR. Any case without a documented reason for not filing is where a look-back starts.
- Re-read the thresholds after every handoff. USBI's error started when filing moved to a different group in 2018. A reorganization, a new case-management vendor, or a merger is the time to check.
- Ask your independent tester to sample what was applied. FINRA Rule 3310(c) requires independent testing every calendar year for most firms. A test that reads only your own AML program can miss a threshold that sits in another team's procedures.
- Read other firms' AWCs. USBI found its error that way, and FINRA counted it in USBI's favor.
This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.
Related reading: TD Bank's $3 billion AML resolution and CICC's $300,000 FINRA fine, a case study in monitoring that missed whole payment types.