The US Securities and Exchange Commission on Monday censured Merrill Lynch, Pierce, Fenner & Smith and imposed a $7.5 million civil penalty over failures to file numerous Suspicious Activity Reports over a more than four-year period. The order, entered on 29 June 2026 in Administrative Proceeding File No. 3-22652, also directs Merrill to cease and desist from further violations.
The SEC found violations of Section 17(a) of the Securities Exchange Act of 1934 and Rule 17a-8, which require broker-dealers to comply with the SAR filing obligations of the Bank Secrecy Act. The findings cover conduct from April 2020 through September 2024.
MONITORING GAPS AT THE CORE
According to the order, Merrill's transaction-monitoring function relied on the Bank of America enterprise Bank Secrecy Act and anti-money laundering programme. The SEC found that certain lower-risk event groups within that programme were never investigated, creating gaps in the coverage of activity that should have been evaluated for SAR filings.
The absence of investigation of those event groups meant that potentially suspicious transactions in the affected categories were not escalated for review and, where warranted, reported. Regulators expect broker-dealers to have monitoring frameworks that reach all in-scope activity, regardless of the initial risk score assigned to a given event type.
The Commission framed the case as one about the integrity of the SAR pipeline rather than individual client conduct. Consistency and completeness of monitoring are foundational to the broader anti-money laundering regime that overlays securities markets.
SEVEN AND A HALF MILLION DOLLAR PENALTY
The $7.5 million civil penalty accompanies the censure and cease-and-desist order, giving the resolution both a monetary and a forward-looking component. Merrill's remediation of the identified gaps in the enterprise BSA/AML programme will remain a focus for supervisors going forward.
The case underscores continued SEC attention to broker-dealer AML obligations, particularly at large integrated firms where transaction monitoring is delivered through affiliate programmes. Firms in similar structures are likely to review the scope of event groups covered by their own monitoring in light of the findings.
The administrative order is available on the SEC's website. Merrill did not admit or deny the findings, as is standard in settlements of this kind.
The conduct period identified by the SEC runs from April 2020 through September 2024, a span that covers a period of heightened supervisory focus on broker-dealer AML programmes and rising expectations for the comprehensiveness of transaction monitoring. Section 17(a) of the Securities Exchange Act of 1934 and Rule 17a-8 tie broker-dealers' AML compliance directly into the securities regulatory framework, giving the SEC clear authority to pursue enforcement where SAR filing obligations are not met. The finding that certain lower-risk event groups within the Bank of America enterprise BSA/AML programme were never investigated points to a structural rather than a case-by-case failing.
For other broker-dealers operating within larger bank holding companies, the message is that reliance on an enterprise-level BSA/AML programme does not relieve the broker-dealer of its own SAR filing duties.
Administrative Proceeding File No. 3-22652, entered on 29 June 2026, records the censure, the cease-and-desist order and the $7.5 million civil penalty in a single settled action, providing the Commission's formal statement of the resolution. The order caps a case that focuses squarely on the completeness of Merrill's transaction monitoring rather than on individual customers or transactions.