What happened.
In October 2024, TD Bank’s U.S. entities pleaded guilty to Bank Secrecy Act and money-laundering conspiracy violations. The Department of Justice described a long-running failure to maintain and update an adequate anti-money-laundering program, despite repeated internal and external warnings.
The issue was not simply the accuracy of individual alerts. Large categories of transactions were outside monitoring coverage, and remediation did not keep pace with the institution’s activity. This case concerns the U.S. retail banking operation; its findings should not be generalized to TD’s Canadian operations.
An alert queue cannot represent the full risk picture if entire transaction categories are absent. Coverage, unresolved warnings, and remediation ownership need to be visible alongside the alerts themselves.
From individual facts to a fuller picture.
- The DOJ described repeated regulatory, audit, and consultant warnings.
- Large categories of transaction activity were outside the monitoring program.
- Which products, channels, transaction types, and counterparties are actually represented in connected data?
- Can related accounts and beneficiaries be examined together rather than as isolated alerts?
- Is every material warning linked to an accountable owner and a verifiable resolution?
The review questions are analytical prompts. They do not establish that particular data was available to the institution at the time, or that a different process would have changed the outcome.
A different decision starts here.
Treat missing monitoring coverage as an exception, then give investigators more context for the activity that is reviewed.
Authorized transaction feeds, the institution’s monitoring scope and alert records, customer identity evidence, and account-closure decisions.
01 Make the blind spots visible
- Evidence to connect
- Transaction populations by product and channel, monitoring inclusion rules, and source availability.
- Amlok output
- A coverage comparison that identifies missing feeds and activity outside the configured review scope.
Decision it could supportEscalate uncovered activity to the AML program owner; an absent feed cannot be scored as low risk.
02 Connect the parties behind the activity
- Evidence to connect
- Account ownership, payment references, customer records, and available counterparty evidence.
- Amlok output
- Named counterparties and supported relationship paths attached to the review.
Decision it could supportPrioritize unexplained flows and related accounts for investigation instead of reviewing each alert in isolation.
03 Focus review without losing the audit trail
- Evidence to connect
- False-positive alert labels, prior investigations, closure decisions, and subsequent account activity.
- Amlok output
- A contextual review package with the evidence, unresolved questions, and follow-up activity.
Decision it could supportLet authorized investigators resolve supported false positives and escalate continuing activity under institution-owned AML policies.
Put numbers behind the opportunity.
These scenarios apply Amlok’s supplied comparison rates to the review described above. They are projections, not measured results at TD Bank (U.S.). Count-based scenarios use an assumed population, not the institution’s actual records.
Manual review burden from AML false-positive alerts
Normalized AML false-positive review burden
The supplied index moves from 100 to 65, leaving 35 fewer burden points for false-positive review.
Calculation & assumptions
Comparison inputs: 100 index → ≈65 index.
Relative change: (65 − 100) ÷ 100 × 100 ≈ −35%.
35 index points lower than the input baseline. Baseline is a normalized burden index of 100. This is not an alert count, hours saved, cost reduction, or detection-accuracy measure.
View the supplied comparison inputsNamed counterparty coverage
Assumed population: 1,000 eligible transaction records.
More reviewed activity would have a named party that investigators can connect to the customer and transaction history.
Calculation & assumptions
Comparison inputs: 65% → ≈86%.
Population calculation: 1,000 × 65% = 650; 1,000 × 86% ≈ 860. Difference: ≈210 additional.
Relative change: (86 − 65) ÷ 65 × 100 ≈ +32.31%.
21 percentage points higher than the input baseline. Assumes comparable resolvable counterparty evidence. This does not turn the historical 92% monitoring gap into a modeled coverage gain.
View the supplied comparison inputsFrom a projection to a validated result.
Use known-at transaction and alert snapshots. Measure source coverage separately from counterparty resolution; compare labeled false-positive review burden while holding suspicious-event detection requirements fixed.
These figures model review quality and burden. They do not estimate money laundering prevented, monitoring coverage restored, or penalties avoided. The supplied comparison rates are approximate scenario inputs; no institution-specific replay or confidence interval is available for these estimates. The two metrics describe separate dimensions and should not be added together.
Read the source material.
The enforcement findings concern TD’s U.S. entities. Amlok’s workflow analysis is retrospective and is not a claim of regulatory approval or a substitute for an institution’s AML program.
- 01
- 02ORX: enforcement summary: cross-agency total and asset capIndustry source
Amlok’s interpretation is independent of the institutions discussed. Public records are limited to their stated scope and period. Historical figures describe the source events; the separately labeled Amlok scenarios are calculated projections. Institution names and logos do not imply affiliation or endorsement.
