The Outlier Lab

Case Study - TD Bank AML Failures (2024)

TD Bank pleaded guilty in 2024 after leaving ~92% of transactions unmonitored while networks and bribed employees moved $670M+; it paid ~$3.09B and accepted a US asset cap.

What happened

  • The monitoring gap. TD's transaction monitoring left out large categories of activity, including domestic ACH and most check activity. New products such as Zelle launched without full monitoring coverage. The bank also allowed more than $5B in activity in accounts it had already decided to close. Internal audit raised concerns repeatedly from 2014 to 2022. DOJ says senior executives held the AML budget flat year over year from January 2014 to October 2023 (an internal "flat cost paradigm") while profits and risk grew. Peer-to-peer activity was not meaningfully monitored.
  • Network 1: cash deposits (Da Ying "David" Sze). From January 2018 to February 2021, the network deposited about $470M+ in cash into nominee accounts at branches in New York, New Jersey and elsewhere. Some single-day deposits exceeded $1M, and the money left through official bank checks and wires. Employees received more than $57,000 in gift cards. One former assistant manager processed 1,680 official checks totaling more than $92M for the network.
  • Network 2: high-risk jewelry business. From March 2021 to March 2023, a jewelry business moved nearly $120M through shell accounts before TD reported it.
  • Network 3: Colombia ATM cash-out. Funds were deposited in the US and withdrawn at ATMs in Colombia. Five employees issued dozens of ATM cards to launderers, enabling about $39M. Accounts were opened with the same reused foreign passports. Across the case, press reported ATM withdrawals running at 40–50 times daily personal limits.
  • Insider data theft. A retail employee took bribes to pass confidential customer data to criminals, who then drained about $485K from customer accounts. That is a direct line from AML failure to third-party transaction fraud (Account Takeover (ATO)).
Diagram: Illicit cash / proceeds, Nominee and shell accounts (insider-assisted), Official checks, wires, ATM cards used abroad, Integration, Monitoring scenarios unchanged, ~92% unmonitored

Timeline

DateEvent
2014–2022Internal audit repeatedly flags monitoring weaknesses. No material scenario changes.
January 2018 – April 2024About 92% of transactions (~$18.3T) unmonitored
January 2018 – February 2021Cash-deposit network moves $470M+
March 2021 – March 2023Jewelry-business network (nearly $120M). Colombia ATM network (~$39M) in the same era.
October 10, 2024Guilty pleas in federal court in Newark, New Jersey. DOJ: $1.43B criminal fine plus $452M forfeiture ($1.89B, after a 20% reduction for partial cooperation and remediation; no voluntary-disclosure credit). FinCEN: $1.3B civil penalty, its largest against a depository institution, with a four-year monitorship. OCC: $450M civil penalty, a $434B cap on the two US bank subsidiaries' combined assets, and a cease-and-desist order. Federal Reserve: $123.5M, credited against the DOJ forfeiture. Total after crediting is about $3.09B. DOJ requires a three-year independent monitor.
February 2025Guidepost Solutions appointed as monitor. TD earmarks about $500M for remediation. CEO and global AML officer depart.
Fiscal 2025 (to October 31, 2025)TD reports $507M of US AML remediation spending, most remediation work done, and similar spending expected in 2026 while internal audit validates the new monitoring and lookback work
January–February 2026Former employees Wilfredo Aquino and Edward Low plead guilty
July 2026Aquino sentenced to 46 months and Low to 24 months

Mechanisms involved

  • Money Mules: nominee accounts and ATM card holders. This is the same cash-out layer most transaction fraud depends on.
  • Insider Fraud: employees bribed to open accounts, issue cards, process checks and leak customer data.
  • Fraud Rings and Collusion: organized networks working with insiders.
  • Account Takeover (ATO): leaked customer data led to drained accounts.

Control gaps

GapWhy it mattered
Monitoring coverage didn't include ACH, checks and new productsMost value movement was invisible (Transaction Monitoring)
Static scenariosKnown typologies (structuring, cash-intensive nominees, foreign ATM cash-out) went undetected (Rule Governance and Change Management)
Audit findings not fixedRepeated warnings over eight years (Three Lines of Defense)
No insider-risk monitoring at branchesEmployees opened accounts and issued cards for criminals (Insider Access Controls, Playbook - Insider Fraud Members)
ATM and cash limits not enforcedWithdrawals far above personal limits (Velocity and Exposure Limits)
Closure decisions not enforcedMore than $5B moved through accounts already marked to close (Negative Lists and Deny Lists)

Detection and response

Detection came from law enforcement, not the bank's own systems. The OCC order requires an independent transaction lookback, OCC approval for new branches, markets and products, and a ban on rehiring employees involved in the misconduct. The asset cap stays until remediation is accepted. If milestones are missed, TD may have to shrink assets by up to 7% at a time. No executives have been criminally charged. TD clawed back bonuses.

Outcome

  • Corporate: guilty plea, about $3.09B in penalties, a $434B US asset cap, probation, monitorship, and a CEO transition.
  • Individuals: DOJ says more than two dozen people were charged across the networks, including two bank insiders as of the October 2024 plea. Former employees Aquino (46 months) and Low (24 months) were sentenced in July 2026.

Lessons for practitioners

  1. AML coverage gaps become fraud losses. The infrastructure that let laundering networks in also let insiders sell customer data that was used to drain accounts. Fraud and AML teams should share coverage maps (BSA-AML and SAR Filing, Three Lines of Defense).
  2. Monitor every rail at launch. A new product launched with incomplete monitoring, as Zelle was at TD, is an unmonitored channel from day one. Make "monitoring coverage confirmed" a launch requirement (New Product and Promo Launch Review, Payment Rails Map).
  3. Retire stale scenarios on a schedule. Eight years without a material change is a governance failure. Version, test and review rules and scenarios regularly (Rule Governance and Change Management, Fraud Strategy Lifecycle).
  4. Include insider risk in transaction-fraud controls. Account opening, card issuance, official checks and customer data access are insider-sensitive. Monitor employee-linked patterns, such as one employee opening many accounts that share devices or documents (Insider Access Controls, Entity Link Analysis).
  5. Mule typologies apply both ways. Nominee accounts with heavy cash deposits, fast outflows and foreign ATM use are the same signals that catch fraud cash-out (Fast In Fast Out Patterns, Playbook - Money Mule Detection Members).
  6. Treat budget as a control. Regulators specifically cited flat compliance spending. Tie fraud and AML capacity to transaction growth, and document how staffing decisions were made (Fraud Operating Model, Neobanks and Consumer Fintech).

Sources