USAA Federal Savings Bank has agreed to pay $140 million after admitting it failed to fix an anti-money-laundering program that authorities said was “rudimentary” and significantly understaffed.
The bank, which caters to military members and their families, willfully failed to implement and maintain an anti-money-laundering program that met the requirements of the Bank Secrecy Act, the U.S. Treasury Department said.
The fine included separate civil penalties imposed by the Treasury’s Financial Crimes Enforcement Network and the Office of the Comptroller of the Currency. The agencies said they coordinated on the settlement.
USAA’s anti-money-laundering failures occurred from at least January 2016 until April 2021, FinCEN said. USAA failed to file at least 3,873 reports about suspicious activity by its customers, including some who used their personal accounts for apparent criminal activity, the agency said.
“As its customer base and revenue grew in recent years, USAA FSB willfully failed to ensure that its compliance program kept pace, resulting in millions of dollars in suspicious transactions flowing through the U.S. financial system without appropriate reporting,” Himamauli Das, FinCEN’s acting director, said Thursday.
USAA said it was cooperating with regulators. “While the issues identified in these orders did not result in any individual member harm, we understand the importance of these requirements,” Chief Executive Wayne Peaco*ck said. “Compliance is a top and urgent priority that is fundamental to providing our members with the highest level of service.”
The bank, which is based in San Antonio, provides retail deposit and consumer loan products for about 13 million customers.
Beginning in 2017, the OCC put USAA on notice that there were significant problems with its anti-money-laundering program, according to a consent order released Thursday.
The bank in 2018 made a commitment to overhaul its compliance program, including by developing adequate customer due diligence and risk identification processes, but has to date failed to meet deadlines to do so, according to FinCEN.
During the time when the violations occurred, USAA’s compliance department was significantly understaffed, and relied heavily on third-party contractors, the agency said.
The bank in 2018 conducted an assessment and found it needed 178 permanent full-time positions to staff its compliance function. As of early 2021, the bank had 62 vacant positions, which included the head of its financial intelligence unit, FinCEN said. About 76% of the bank’s compliance staff needs were met by third-party contractors, the agency said.
USAA’s case alert and investigations system also was chronically deficient, according to the consent order. In 2021, the bank installed a new transaction-monitoring system, but failed to test it adequately before launch.
As a result, the new system failed to flag more than1,300 cases the legacy system was able to catch, representing at least 160 suspicious activity reports that would have gone unfiled, FinCEN said.
The new system is now too sensitive and creates an unmanageable number of alerts and cases, the agency said. At the end of 2021, USAA had a backlog of around 90,000 alerts and 6,900 cases yet to be reviewed, the agency said.
FinCEN also pointed to a number of failings by USAA with respect to internal audits, training and customer due diligence policies.
Write to Dylan Tokar at dylan.tokar@wsj.com
Copyright ©2022 Dow Jones & Company, Inc. All Rights Reserved. 87990cbe856818d5eddac44c7b1cdeb8
