Filing is not finding: FinCEN’s effectiveness question meets the FinCEN Files

The week

In mid-September 2020, the Financial Crimes Enforcement Network published an advance notice of proposed rulemaking asking for comment on whether to define an “effective and reasonably designed” anti-money laundering program in regulation. The notice suggested that effectiveness could mean identifying and managing risk, complying with Bank Secrecy Act requirements, and providing information with a high degree of usefulness to government authorities, guided by national AML priorities.

Days later, on September 20, BuzzFeed News and the International Consortium of Investigative Journalists began publishing the FinCEN Files, a series based on leaked suspicious activity reports filed by banks. The reporting described large flows of suspicious funds that banks had flagged, often after the fact, while the transactions continued.

The two events had unrelated origins, but they addressed the same question from opposite ends. FinCEN was asking how to measure whether anti-money laundering programs produce value. The leaked reports showed what the system looked like when activity was reported and little changed. For compliance and technology leaders at banks, credit unions and broker-dealers, three things the system had blended need separating: how much is reported, how useful the reports are, and what the institution does after filing. Each has a different owner, a different data source and a different metric.

How much is reported

For years the incentives pointed toward more. Examiners criticized missed filings far more often than unnecessary ones, so defensive filing was rational. Monitoring systems were tuned to generate alerts, and alert queues were staffed to clear them. Program health was described in alerts reviewed, cases opened and reports filed.

The FinCEN Files reporting showed the limit of that approach. Many leaked reports described activity flagged long after it happened, sometimes repeatedly for the same customers. Filing met the legal obligation. It did not necessarily stop anything. A program that measures itself by filings will produce filings.

Volume is still worth measuring, as long as it is read for what it signals. A false positive rate near the ceiling says the monitoring rules are blunt. A rising count of reports on existing customers, as opposed to new ones, says the program is recording the same risk repeatedly. Both are tuning signals, and both sit in the case management system already.

How useful the reports are

The advance notice’s central idea was that a report should be judged by its value to the authorities who receive it. That changes the design question from whether the institution filed to whether it filed something an investigator can act on.

Usefulness depends on factors that compliance and technology teams control:

• Narrative quality. Who did what, when, through which accounts, and why it is suspicious, written plainly instead of in boilerplate.
• Data quality. Correct identifiers, counterparties and linked accounts. These come from upstream customer and transaction data, not from the investigator.
• Timeliness. A report that arrives months after activity ends helps reconstruct history. It rarely helps interrupt anything.
• Priority alignment. Effort weighted toward the threats the government has named as most important, instead of spread evenly across every alert type.

Most of these are data problems. An institution with fragmented customer records cannot link a suspicious transfer to the same person’s other accounts, so its reports describe fragments. Entity resolution, the work of recognizing that several records describe one person or business, is the single investment that most improves report quality. It is also the one most often deferred, because it looks like infrastructure.

The feedback loop is the other gap. Institutions rarely learn which of their reports law enforcement used. Where feedback exists, through law enforcement requests, subpoenas or keep-open letters, it should be recorded against the original report. Those links are the closest thing a bank has to a usefulness measure.

What happens after filing

A suspicious activity report does not, by itself, require an institution to close an account or block a transaction. Those are risk decisions the institution makes under its own policies. The FinCEN Files raised hard questions about repeated reports on the same customers with no visible change in the relationship.

Every program should be able to answer three questions from its own records. How many customers have been the subject of more than one report in a year? What decision was made about each relationship? Who made it, and on what basis? If those answers require a manual project, the program is filing without learning, and that is where supervisory criticism and reputational damage concentrate.

The systems problem is usually fragmentation. Monitoring, investigations and customer due diligence often run on separate platforms, sometimes from separate vendors and teams. An investigator reviewing an alert may not see prior reports on the same customer, the due diligence file or the relationship manager’s notes. Connecting those records is unglamorous integration work. It decides whether a program can act on what it already knows.

Relationship decisions also need an escalation path that works. A repeat-subject customer who is profitable to a business line creates pressure to keep the account. A documented threshold, for example a second report within twelve months triggering a mandatory relationship review by someone outside the business line, removes that decision from the people with the strongest incentive to defer it.

A board that sees only filing counts is looking at the least informative of the three measures. A short report that pairs false positive rates, time from activity to filing, recorded law enforcement follow-up and the share of repeat-subject customers with a documented decision tells a far more useful story. None of this argues for filing less as a goal. It argues for connecting reporting, investigation and relationship decisions so that each can be seen. Institutions should confirm their specific obligations with counsel.

With hindsight

Within months, Congress enacted the Anti-Money Laundering Act of 2020 as part of the annual defense authorization law, writing much of the effectiveness agenda into statute. FinCEN published its first national AML and countering-the-financing-of-terrorism priorities in June 2021. A proposed rule to make programs effective, risk-based and reasonably designed followed in July 2024. FinCEN withdrew that proposal and replaced it with a new one in April 2026, which separates program design from implementation. As of this writing it has not been finalized.

The shift in emphasis from activity to outcomes has held. Examiners and institutions talk more about feedback, prioritization and report quality, and many banks have invested in entity resolution and analytics. The incentive problem has proved harder. Defensive filing remains common because missing a report still feels costlier than filing a weak one. Programs that can show their own loop from alert to relationship decision are best placed whatever the final rule says.