BSA consent orders that ordered KYC remediation, case by case

A BSA consent order is an enforcement action, agreed to by the bank, in which a regulator such as FinCEN, the OCC, the Federal Reserve or the FDIC sets out Bank Secrecy Act failures and orders specific fixes, often with a penalty. When the failures involve customer due diligence, the orders read alike: they require the bank to find the customers whose files fall short, bring them up to standard by a date, look back for suspicious activity it missed, and show progress against milestones. That is a KYC remediation written by a regulator. Botminds' KYC Remediation runs that kind of programme on a bank's own files, with every closure cited and the burn-up a board or an examiner can follow.

Every case below is quoted from the regulator's order or press release, linked where it appears. Some figures, such as combined penalty totals across agencies, are left out where the agencies' own documents could not be checked.

What is a BSA consent order, and why does KYC sit in most of them?

A BSA consent order is a regulator's formal enforcement action, entered with the bank's consent, that records violations or unsafe practices under the Bank Secrecy Act and orders corrective action. Some carry a civil money penalty; some, especially from bank supervisors, carry none and instead impose plans, deadlines and approvals. Several agencies may act on the same failures: FinCEN under the BSA, the bank's federal supervisor under its own authority, and state regulators, and the Justice Department where conduct is criminal.

KYC sits in most BSA/AML consent orders because customer information is what every other control runs on. A risk rating built on missing data under-rates the customer; monitoring tuned to the wrong expected activity misses what matters; a SAR investigation without the customer's profile cannot judge what is unusual. When regulators diagnose an AML failure, they usually find a customer-information failure underneath it, and the remedy reaches back to existing customers.

The casebook: seven orders and what they required for existing customers

Read down the right-hand column and the shape of a remediation emerges: identify the customers whose files fall short, update their due diligence, decide what happens when customers do not cooperate, look back for activity the old files hid, and show progress against a plan the regulator has approved. None of these orders tells a bank how to do the work. All of them tell it what the result must be, and by when.

TD Bank: 1.6 million customers never risk-scored

TD Bank is the largest KYC back-book failure on the public record. FinCEN's 2024 order records that AML personnel reported "a backlog of 1.6 million customers had been identified that were never scored for risk rating", that a sample analysis suggested the high-risk customers in that population "may have exceeded 200,000 customers", and that "the committee members ultimately recommended against any remedial work specific to this large population of unscored customers" (FinCEN Consent Order No. 2024-02). FinCEN imposed a $1.3 billion penalty; separately, the bank pleaded guilty and agreed to pay over $1.8 billion in criminal penalties, with the Justice Department finding that 92% of total transaction volume had gone unmonitored from 2018 to 2024 (US Department of Justice).

The OCC's order set the repair. Within 120 days, TD had to implement a CDD programme covering new accounts, renewals and event-driven updates, including procedures to impose timely consequences on customers who fail to provide required CDD information, periodic review criteria and a quality control process (OCC AA-ENF-2024-77). Its SAR look-back reaches the files directly: "The SAR Look-Back Consultant shall facilitate the updating of the due diligence information for existing moderate- and high-risk customers identified during the SAR Look-Back." FinCEN's order requires the look-back report no later than April 2027.

The decision the order quotes is the one boards should notice. A remediation was considered and declined. The cost of that decision arrived years later, multiplied, and with a regulator writing the plan. Pricing a remediation before an order, and pricing each month of delay, is the subject of an AML remediation plan priced by the month.

What is a BSA lookback? SAR, CIP and customer lookbacks

A BSA lookback is a review, ordered or self-initiated, of a past period to find what a failed control missed. Three kinds appear in these orders. A SAR or transaction lookback re-examines past activity for suspicious transactions that should have been reported: Blue Ridge was ordered to run a revised SAR look-back from September 1, 2022 (OCC), and Bank of America's 2024 lookback found it had failed to file nearly 8,900 SARs on activity of nearly $4 billion (FinCEN). A CIP lookback re-checks identification on accounts opened in a period. A customer or CDD lookback updates the files themselves.

Sutton Bank's order is the clearest CIP example. The FDIC required a plan within 60 days for a lookback of prepaid card customers, reaching back to accounts opened from July 1, 2020, to confirm that every required piece of CIP information was on file and that the bank could reasonably say it knew who each customer was, and required the review to be complete within 120 days (FDIC-23-0110b). The lookbacks interact: a SAR lookback needs good customer profiles to judge activity, and TD's order uses its SAR look-back to update the files of the customers it touches.

USAA and Bank of America: what happens when a remediation deadline slips

A missed remediation deadline does not end the obligation; it adds an order. USAA had committed in 2018 to develop adequate CDD, EDD and customer risk processes, and FinCEN found it failed to make adequate progress against the March 31, 2020 deadline; in March 2022 FinCEN imposed $140 million and the OCC a $60 million penalty with a cease-and-desist order (FinCEN Consent Order No. 2022-01). The OCC's order required CDD whenever events showed information missing or incomplete, and told the bank to write the criteria that would trigger those updates (OCC EA 2022-008; the trigger events regulators have named sets the orders side by side).

Bank of America shows the same pattern four years later. The OCC's October 2026 penalty order found "The Bank has not made sufficient progress in addressing its multiple internal control weaknesses since the 2024 Order was issued" and assessed $750 million (OCC AA-ENF-2026-41), and FinCEN's $1.2 billion penalty the next day credited that payment; FinCEN found that, in some instances, bank staff had carried the same observations from one quarter into the next in high-risk customer reviews (FinCEN Consent Order No. 2026-03). Progress is measured, and lack of it is penalised.

Fintech partner banks: Evolve, Sutton and Blue Ridge

Three of the seven orders concern banks whose customers arrived through fintech partners, and all three reached back to existing customers. The Federal Reserve required Evolve to submit a CDD programme with "documentation necessary to verify the identity, source of wealth, and business activities of the customer" and a plan, with milestones, to remediate deficient due diligence on existing customers of its partner division (Federal Reserve, Evolve Bank & Trust). The FDIC required Sutton's lookback; the OCC required Blue Ridge to obtain CDD, EDD and ownership for all customers, at opening and on an ongoing basis.

The pattern is that the bank, not the partner, owns the file. A partner that collected less than the bank's programme requires, or collected it in a system the bank cannot read, leaves the bank with a remediation when the supervisor arrives. For a partner bank the scope question is which programme's customers, opened in which window, against which standard, and the definition of KYC remediation starts there.

How long do BSA consent orders last?

A BSA consent order lasts until the regulator terminates it, which in practice means until the bank has shown the ordered fixes work. Orders set deadlines for each plan and deliverable, but the order itself has no fixed end date. The cases show what extends them: USAA's 2018 commitments were followed by 2022 orders and, according to the OCC, a further order in 2024 on noncompliance with the earlier ones; Bank of America's 2024 cease-and-desist was followed by a 2026 penalty for insufficient progress; Blue Ridge's 2022 formal agreement was replaced by the 2024 cease-and-desist.

For a board, the practical answer is that an order lasts as long as the remediation takes to prove, plus the time to validate it. A programme that finishes its files but cannot show evidence for each closure has not finished. That is why the burn-up and the evidence behind it matter as much as the file count.

A burn-up a board or examiner can follow, file by file

What the orders have in common, as a checklist a board can price

Read together, the orders describe the components of a regulator-written remediation. A bank that has not been ordered can use the same list to scope its own programme and price it before someone else does.

Showing progress the way the orders ask, with KYC Remediation

KYC Remediation is built to produce the evidence these orders ask for as a by-product of the work. Every file sits in one state on one programme page, so the count the board sees is the count in the analysts' queues. Every closure cites the record it rests on, every batch carries a named maker, a different checker and the sample behind the approval, and customers who do not answer go through a set sequence: a call first where there are signs of vulnerability, and a limit on services only after an analyst prepares it, a reviewer checks the notice and the BSA officer approves.

An examiner pack built from the same audit trail the work produced

What the solution does not do is decide for the bank. It does not set the scope, write the plan the regulator approves or choose which customers to restrict; people do, with the evidence in front of them. To see the programme page, the batch approvals and the examiner pack together, start from KYC Remediation.

Questions people ask

What happens when a bank gets a BSA consent order?

The bank must deliver what the order lists, usually plans, look-backs, programme changes and progress reports, by the dates it sets, often subject to the regulator's non-objection. Some orders add penalties or restrict growth or new business. TD's OCC order, for example, gave 120 days for a new CDD programme.

What was the TD Bank AML remediation about?

The orders required TD to rebuild its AML programme, including customer due diligence and transaction monitoring. FinCEN's order recorded 1.6 million customers never risk-scored and a committee recommendation against remediating them. The OCC's order requires procedures to remediate missing CDD, and a SAR look-back that updates due diligence on moderate- and high-risk customers.

What is a BSA remediation order?

It is a consent order, or part of one, that requires the bank to remediate specific BSA failures, often with a plan the regulator approves. Evolve's 2024 order, for example, required a plan with intermediate timelines and milestones to remediate due diligence on existing customers.

What is a transaction lookback?

A review of past transactions to find suspicious activity that should have been reported but was not, usually run by an independent consultant under an order. Bank of America's 2024 one-time lookback found nearly 8,900 SARs that had not been filed, on activity of nearly $4 billion.

Do consent orders require banks to close accounts of customers who do not respond?

They require the bank to have a policy and apply it. TD's OCC order requires procedures that impose prompt consequences on customers who do not supply required CDD information, and Sutton's order requires the bank to set out when accounts must be closed. The consequence for each customer is the bank's decision under that policy.