AML risk score gaps at TD Bank: 1.6 million customers never rated

In TD Bank's case, the AML risk score gap was concrete: in September 2019 the bank's AML staff told a committee of senior executives, including the BSA Officer, that 1.6 million customers had never been scored for risk rating, and a sample suggested more than 200,000 of them might be high risk. The committee recommended against remediating that population. Five years later, on October 10, 2024, FinCEN imposed a record $1.3 billion penalty and a four-year monitorship, the OCC imposed $450 million and an asset cap, and the Federal Reserve fined the parent $123.5 million, for failures that ran across the whole AML program and named customer risk ratings among them. An AML risk score is the number or tier that sets how closely a bank watches a customer; a customer without one is watched by default rules or not at all. Botminds' Customer Risk Rating exists to keep every customer rated, re-scored when a fact changes, and explained in a sentence two people sign.

The account below is drawn from FinCEN's consent order and the OCC's and Federal Reserve's releases. TD Bank admitted the facts in its plea agreements with the Justice Department and neither admitted nor denied the rest of FinCEN's findings; the Justice Department's figures are not used here.

What happened with TD Bank's AML risk scores?

FinCEN found that TD Bank's process for identifying high-risk customers "was insufficient and improperly administered due to TD Bank's inadequate staffing and failure to maintain the necessary software," with deficiencies spanning "the Bank's primary risk rating system for its customers, as well as related data feeds and processes" (FinCEN Consent Order 2024-02). The problems were not hidden: AML senior management reported them repeatedly.

The order lists them in sequence. In January 2019 the bank identified at least 65 unresolved issues with the rating system dating back to 2016, including risk scores that displayed "a string of arbitrary numbers" instead of a date, time and score. Around the same time a subset of customers turned out to have been omitted from scoring, which surfaced more than 500 high-risk customers the AML group had never identified as such. The bank "took no steps to scrutinize this population of customers or the transactions they had effected through the Bank while they were not classified as high-risk customers."

Data feeds failed too. In 2019 the BSA Officer was told that customer updates made while a computer memory issue persisted were never factored into risk scores, so the scores were built on information the bank already knew to be out of date. A rating system that reads stale data produces confident, wrong answers, which is worse than an obvious gap.

1.6 million customers unscored, and a committee that chose not to fix it

The decisive moment was a choice, not a defect. In September 2019, with the rating projects in "red" status, AML personnel reported that "a backlog of 1.6 million customers had been identified that were never scored for risk rating." The committee, which included the BSA Officer, weighed a sample suggesting high-risk customers in that population "may have exceeded 200,000," and "ultimately recommended against any remedial work specific to this large population of unscored customers, in part because it would compete with ongoing risk-related projects and resources" (FinCEN Consent Order 2024-02).

The same discussion turned to presentation. The committee members "discussed the importance of Bank personnel 'align[ing] on messaging to regulators' regarding customer risk-rating processes." A second problem followed: customer accounts linking to the wrong unique identifiers left about 5.2 million accounts, belonging to more than 2.5 million customers, unscored or wrongly scored, still categorized months later as "complicated" and needing "extended analysis."

The schedule then slipped as schedules do when a fix competes for budget. In November 2019 management said all rating projects would be delayed to mid-2020, with a final resolution date of February 2021. In April 2020 the committee identified further projects, "many of which had been deferred due to resource constraints." The bank adopted a new risk scoring method only in 2023, which required rescoring every customer.

How much was TD Bank fined? Three regulators, one record

FinCEN assessed $1.3 billion, which it called "the largest penalty against a depository institution in U.S. Treasury and FinCEN history," with a four-year independent monitorship (FinCEN press release, October 10, 2024). The OCC imposed a $450 million civil money penalty and a cease and desist order on TD Bank, N.A. and TD Bank USA, N.A. The Federal Reserve fined the parent, Toronto-Dominion Bank, $123.5 million (Federal Reserve, October 10, 2024).

The FinCEN figure needs one more line of arithmetic. FinCEN "agreed to credit against the $1.3 billion Civil Money Penalty payments of $543 million to DOJ and the OCC," so TD Bank paid $757 million to the Treasury under that order (FinCEN Consent Order 2024-02). The headline numbers from different agencies overlap, and a board briefing that adds them up overstates the cost.

What is the TD Bank asset cap?

The OCC's order limits the total consolidated assets of TD Bank's two U.S. national banks to what they reported on September 30, 2024, for as long as the order lasts. If the banks miss the OCC's approved timeline for compliance, the OCC may require them to shrink by up to 7%, and by up to a further 7% for each additional year of noncompliance (OCC fact sheet). The banks also cannot open a branch or enter a new market without the OCC's no-objection.

The OCC listed what went wrong in one sentence that reads like a table of contents of a BSA program: deficiencies "included those related to internal controls and risk management practices; risk assessments; customer due diligence; customer risk ratings; suspicious activity identification, evaluation, and reporting; governance; staffing; independent testing; and training" (OCC News Release 2024-116). Customer risk ratings sit in the middle of that list, between the due diligence that feeds them and the monitoring that depends on them.

How an unrated book becomes a cost

An unrated customer costs nothing until the rating would have mattered, and then it costs the investigation the bank did not run. The FFIEC manual describes the mechanism: "Improper identification and assessment of a customer's risk can have a cascading effect, creating deficiencies in multiple areas of internal controls and resulting in an overall weakened BSA compliance program" (FFIEC, CDD overview).

FinCEN's order gives a case. In July 2019 TD Bank onboarded a New York religious institution whose leader had publicly known ties to terrorist organizations; the bank "failed to categorize this customer relationship as high-risk, consequently failing to perform EDD reviews and properly monitor its transactions." A newly implemented scenario looking at changes in customer behavior eventually caught it, and the bank filed a SAR in April 2024, acknowledging that the activity indicative of terrorist financing "began four years prior."

Even a correct rating did not guarantee scrutiny. The bank's procedures put the highest-risk customers, its Tier I group, under the most frequent reviews, yet FinCEN found it "required only a 90-day review window of transactional activity" for them. A tier is only as good as what it triggers, which is why the purpose of a customer risk profile in a CDD program is to set what monitoring and due diligence the customer receives.

Flat spending, growing backlogs: the budget behind the gap

FinCEN tied the rating failures to money. TD Bank "vastly underinvested in its AML compliance efforts, with TD Bank knowingly spending an order of magnitude less than its peers," and "during the periods of TD Bank's most acute issues (including those related to backlogs from insufficient staffing), AML spending remained flat" (FinCEN Consent Order 2024-02). Annual self-assessments by AML leaders listed as an accomplishment their ability "to 'develop [the AML] program within a flat cost paradigm without compromising risk appetite.'"

The lesson is not that every bank must spend like its largest peer. It is that a rating backlog is a measurable liability, and a budget that cannot clear it is a decision someone should sign. A board told "1.6 million customers are unscored, and remediation competes with other projects" is being asked to accept a risk; it should be asked in those words.

What a board should see each quarter: coverage, movement and timeliness

What did the TD Bank orders require?

The orders require a rebuilt program, verified by outsiders, with growth held back until it is done. The OCC's fact sheet lists the components; for a rating program, each has a direct counterpart.

What a board should ask about its own rating coverage

A board does not need to understand a scorecard to govern one. It needs a handful of numbers each quarter and the habit of asking why any of them moved. The questions below come straight from what went wrong in the TD Bank findings.

Customer Risk Rating is designed so these answers exist without a project to assemble them. A Fact Watcher reads the core banking, monitoring, account-opening, screening and case systems each night, every member is re-scored when a fact changes, the whole book is re-scored on a schedule as well, and the supervisory committee report is drafted with every figure cited. How a customer risk rating system reads the data already held explains the mechanics; how to validate the method covers the rest.

Every member's rating as a history of sentences, with maker and checker

Questions people ask

What is an AML risk score?

A number or tier, usually low, moderate or high, that summarizes a customer's money laundering risk and sets how closely the bank monitors it and when enhanced due diligence starts. The CDD rule requires a customer risk profile; most banks express it as a score or tier, and the FFIEC manual uses the profile and the rating as two names for the same thing.

Why did TD Bank fail AML?

FinCEN found program-wide failures: trillions of dollars a year in unmonitored transactions, alert backlogs, late and missing SARs, defective customer risk rating, and AML spending held flat while problems grew. The OCC's list of deficiencies runs from internal controls and risk assessments through customer risk ratings to staffing, testing and training.

What is a customer risk rating gap?

A population of customers with no current risk rating, or with ratings computed on missing or stale data. At TD Bank it included 1.6 million customers never scored and about 5.2 million accounts left unscored or wrongly scored by a linking error. Each gap means monitoring runs on defaults for those customers.

How long does the TD Bank monitorship last?

FinCEN imposed a four-year independent monitorship, under which the monitor oversees an end-to-end review of the AML program and a SAR lookback carried out by an independent consultant. The OCC's asset cap lasts for the duration of its order.

Did TD Bank admit the findings?

TD Bank admitted the facts set out in its October 10, 2024 plea agreements with the Justice Department and neither admitted nor denied the rest of FinCEN's findings, while consenting to the order and the penalty.