Case Study: TD Bank 2024 Enforcement Actions

Background

On October 10, 2024, TD Bank N.A. and TD Bank US Holding Company pled guilty to conspiracy to fail to maintain an adequate AML program (31 U.S.C. s.5318(h)) and conspiracy to commit money laundering (18 U.S.C. s.1956(h)). The combined penalties totalled approximately $3.09 billion — the largest BSA enforcement action in history.

Penalty breakdown (approximate):

Agency	Amount	Instrument
DOJ	~$1.8B	Criminal fine + forfeiture
FinCEN	~$1.3B	Civil money penalty
OCC	~$450M	Civil money penalty (AA-EC-2024-71 [partially verified])

The OCC also imposed an asset cap on TD Bank's U.S. operations (~$434B), only the second such restriction on a major bank after Wells Fargo in 2018.

Sources: - DOJ press release, October 10, 2024 - FinCEN consent order (Assessment No. 2024-04 [partially verified]) - OCC consent order (AA-EC-2024-71 [partially verified])

Key Findings

1. Channel Coverage Gap (~92% Unmonitored)

TD's transaction monitoring system was configured to monitor only a narrow set of transaction types — primarily international wire transfers. Domestic ACH, cheques, and certain other channels were excluded entirely. Approximately 92% of transaction volume (by dollar value) — over $18.3 trillion between 2018 and 2024 — was never reviewed by automated monitoring.

2. Pass-Through / Rapid Movement

Criminal networks deposited funds (often via ACH or cash) and withdrew or transferred them out within hours or days. One network moved over $470 million through TD accounts between 2019 and 2023 using this pattern. A second moved approximately $39 million.

3. Shell Companies and Nominee Accounts

Accounts were opened in the names of shell companies or entities with no apparent legitimate business purpose. CDD/KYC failures meant the bank did not identify true beneficial owners.

4. Internal Alert Failures

Multiple TD employees filed internal suspicious activity referrals that were not investigated, not escalated, or not acted upon. At least five employees were identified as facilitating or complicit in laundering schemes. Branch-level concerns went nowhere because the compliance infrastructure failed to act on referrals.

5. SAR Filing Delays

SARs were filed months or even years late. The bank had a backlog of thousands of unreviewed alerts. Under-filing was systemic — SAR volume was inconsistent with the bank's transaction volume and risk profile.

Traceability: Finding to Spec Clause

The table below maps each TD finding to the specific clause in examples/canadian_schedule_i_bank/aml.yaml that would surface the gap. This is not a claim that the framework would have prevented the enforcement action — it is a traceability example showing that spec-driven controls make these gap patterns visible and measurable.

TD Finding	Spec Clause	How It Surfaces
92% unmonitored channels	metrics.channel_coverage_gap (coverage formula, target: 100%)	Metric turns RED if any declared channel lacks a detection rule. Audience: SVP, VP, Director.
Pass-through ($470M+)	rules.rapid_pass_through (custom_sql: cash-in → e-transfer-out within 48h, ≥$30k)	Rule fires on the planted pass-through scenario (C0007). Tags: [pass_through, layering, e_transfer, td_finding].
Shell companies	rules.shell_company_indicators (custom_sql: no business_activity + 10+ incoming wires)	Rule fires on planted shell company (C0008, Oceanic Holdings Ltd). Tags: [shell_company, layering, beneficial_ownership].
Internal alerts ignored	metrics.internal_alert_ignored (repeat-alert rate: closed_no_action then re-alerted within 90d)	Metric turns RED if >5% of closed cases re-surface. Audience: VP, Director, Auditor.
SAR filing delays	metrics.str_filing_latency_p95 (target: ≤30 days per PCMLTFR)	Metric turns RED if p95 filing latency exceeds 30 days. Audience: SVP, VP, Director, Auditor.
Under-filing / LCTR gaps	metrics.lctr_completeness (target: 100% of reportable cash transactions reported)	Metric turns RED if any reportable cash transaction lacks an LCTR.
CDD/EDD failures	metrics.edd_review_adherence (target: ≥95% of high-risk customers have current EDD)	Metric turns RED if <80% of high-risk customers have a current review.
Inadequate program	metrics.typology_coverage + metrics.rules_active_count	Coverage below 80% turns RED. Active rules below 4 turns RED.
Compliance culture	workflow.queues with SLAs + reports per audience	Spec-driven workflow forces every alert through a queue with a timed SLA and named owner.

Reports That Would Have Flagged It

The spec generates five audience-specific reports:

Report	Audience	What It Shows
cao_quarterly	SVP (Chief AML Officer)	Channel coverage gap, typology coverage, STR filing latency, LCTR completeness
mlro_monthly	VP (MLRO)	Repeat-alert rate (internal alerts ignored), EDD adherence, escalation health
fintrac_readiness	Director	Coverage controls, regulatory compliance, escalation integrity
ops_daily	Manager	Queue load, SLA compliance, transaction volume
osfi_exam_prep	Auditor	Full coverage + filing + escalation evidence package

Regulatory Citations in the Spec

Every rule in the spec cites the regulation clause that justifies it:

Rule	Citations
structuring_cash_deposits	PCMLTFA s.11.1, PCMLTFR s.7(1)
rapid_pass_through	PCMLTFA s.7, FINTRAC Operational Alert 2016-01
shell_company_indicators	PCMLTFA s.7, PCMLTFR s.138, OSFI Guideline B-8 s.4
high_risk_jurisdiction	PCMLTFA s.9.4, FINTRAC Guideline 8A
large_cash_lctr	PCMLTFR s.7(1), PCMLTFR s.132
unusual_volume_spike	PCMLTFA s.7, PCMLTFR s.123.1
dormant_account_activity	PCMLTFA s.7, FINTRAC ML/TF Indicators