TD Bank's 2024 guilty plea cost US$3.088 billion. The record shows its monitoring never looked at 92% of its transaction volume, and the fix it points to is the one mixture-of-experts models needed: pay the system to spread its attention.
Every year, TD Bank's head of anti-money-laundering for its U.S. business and its Bank Secrecy Act officer wrote a self-assessment. According to the Treasury's Financial Crimes Enforcement Network, both listed the same accomplishment: their ability to "develop [the AML] program within a flat cost paradigm without compromising risk appetite."
On October 10, 2024, the bill for that paradigm arrived. TD Bank, N.A. and its U.S. parent pleaded guilty to Bank Secrecy Act violations, and the bank's parent company says the global resolution cost "US$3.088 billion (C$4.233 billion)." That is the Justice Department's criminal fine and forfeiture plus penalties from FinCEN, the Office of the Comptroller of the Currency and the Federal Reserve. FinCEN called its own $1.3 billion share "the largest penalty against a depository institution in U.S. Treasury and FinCEN history." The bank's two U.S. subsidiaries were also capped: their combined average assets may not exceed US$434 billion, and the OCC may require further cuts of up to 7 percent for each year they remain out of compliance.
The usual reading of a case like this is a culture story: a bank that didn't care enough. The record supports something more specific, and more useful to anyone who builds detection systems. It describes a bank that decided where to look and then kept not looking at the rest.
Start with the part that looks like the familiar story of alert fatigue, because it is real.
FinCEN's consent order says TD's "persistent under-resourcing and understaffing reverberated throughout every aspect of its AML program, but were especially apparent in the extensive, persistent, and prolonged backlogs." In 2018 the program "registered over 70,000 backlogged detection alerts and roughly 3,000 aged subpoena responses and further investigation cases, with less than 60% of alerts falling within benchmarks for timely detection." An internal action plan that June named the root cause: "inadequate staffing levels, as well as transaction monitoring system issues." Contractors were hired to "gradually reduce" the backlog, and the bank "nonetheless failed to investigate thousands of alerts for almost a year." In 2022, "the AML headcount decreased to less than 2020 totals, while the number of transaction monitoring alerts of potentially suspicious transactions continued to rise."
If you have ever run an on-call rotation, you know this shape. More alerts than people, a queue nobody can clear, a dashboard that goes red and stays red. It is tempting to stop here and call TD a signal-to-noise failure: a bank drowning in rule-based alerts while the transactions that mattered slipped through the noise.
That reading is half right. The other half is bigger.
The Justice Department's statement of facts, attached to the plea agreement, puts it in one sentence. Between January 1, 2018 and April 12, 2024, TD Bank's "automated AML monitoring failed to monitor 92% of transaction volume and 74% of transaction value, which corresponded to over 14.6 billion unmonitored transactions and over $18.3 trillion in unmonitored transaction value."
That wasn't an accident of volume. The bank "omitted all domestic automated clearinghouse ('ACH') transactions, most check activity, and numerous other transaction types from its automated transaction monitoring system." FinCEN adds that "roughly half of TD Bank's fund transfers went unmonitored and included international debit card purchases."
To be fair to the numbers, DOJ says the unmonitored volume "included a mix of lower- and higher-risk transactions." Most of it was presumably ordinary payroll deposits and utility bills. That is the point, though. Nobody at the bank could say which part was which, because none of it went through the system that was supposed to tell them.
And some of what didn't reach a detector had once had one. FinCEN describes a scenario that watched for large cash deposits in commercial accounts. It was "paused," and "although this 'pause' was framed as temporary at that time, the scenario remained dormant for at least a decade. As a result of this oversight failure, the Bank's transaction monitoring system failed to generate over 150 alerts for suspicious activity related to a scheme involving a group of TD Bank customers (Customer Group A) that purported to operate in the precious metals industry."
The rule existed. Someone switched it off, and no process ever asked whether it should come back. Elsewhere the order notes "a backlog of 1.6 million customers" who "were never scored for risk rating." The monitoring vendor, for its part, recommended that the bank "first address alert aggregation methodology and ensure all alerts were being closed with a true understanding of worthiness."
So the alert backlog wasn't the main failure. It was the visible edge of one. The queue held the cases the system happened to flag. The exposure was everything that never entered it.
A detection program is an optimizer. It does what it is graded on. The consent order is unusually direct about what TD's program was graded on.
"During the periods of TD Bank's most acute issues (including those related to backlogs from insufficient staffing), AML spending remained flat." Management "prioritized 'flat cost' budgeting over compliance, only significantly increasing resources late in the Relevant Time Period and largely after the Bank was aware it was under investigation." FinCEN calls it a "pennywise, pound-foolish approach." It also says TD "gained an unfair and inappropriate advantage over its peers by spending an order of magnitude less on AML compliance." DOJ adds that senior executives "repeatedly prioritized the 'customer experience' over AML compliance and enforced a budget mandate, referred to internally as a 'flat cost paradigm.'"
DOJ's statement of facts shows what that meant for the machinery itself. For most of a decade the bank failed "to substantively update its transaction monitoring system, which is used to detect illicit and suspicious transactions through the Bank, between 2014 and 2022 despite rapid growth in the volume and risks of the Bank's business and repeated warnings about the outdated system."
Once you see the objective, the rest follows. A monitoring system that grows only when its budget grows cannot follow transaction volume that keeps growing. New payment types get added to the business and not to the monitoring. A paused scenario costs nothing to leave paused. And an unmonitored transaction is by far the cheapest one to review, because nobody ever reviews it.
The consequences are in the plea. Three money laundering networks "collectively transfer[red] over $670 million through TDBNA accounts," and "at least one scheme had the assistance of five store insiders." FinCEN says the bank "willfully failed to file Suspicious Activity Reports (SARs) on thousands of suspicious transactions—totaling approximately $1.5 billion." It also found that "from 2017 to 2021, TD Bank facilitated over $400 million in transactions for Da Ying Sze," who pleaded guilty to money laundering in 2022. Only in the last months did the bank move. The consent order records it "nearly doubling its AML staff over a six-month period ending in May 2024."
People who train large models will recognize this failure, from the inside of their own systems.
A mixture-of-experts model routes each input to a few specialist subnetworks, the "experts," chosen by a small gating network. In 2017, Noam Shazeer and colleagues at Google Brain described what happens if you train that router naively. "We have observed that the gating network tends to converge to a state where it always produces large weights for the same few experts. This imbalance is self-reinforcing, as the favored experts are trained more rapidly and thus are selected even more by the gating network."
The favored experts get more traffic, so they get better, so they get more traffic. Capacity that could have learned the rare, hard cases starves, because nothing sends it anything to learn from. The fix in the paper is not a better expert. It is a change to the objective: an extra loss term that penalizes the model when the "importance" of the experts, the total routing weight each one receives, is uneven. The router is paid to spread its attention.
TD's monitoring had the same shape. Attention went to the transaction types it already covered, because they were already covered. Those scenarios got the tuning and the investigators, so they stayed the program. FinCEN puts the self-reinforcing part in governance language: "Bank leadership allowed temporarily 'paused' scenarios to remain dormant for years and failed to implement new scenarios even after identifying risks." Identifying a risk and building a scenario for it are two separate costs, and a flat budget pays for neither. Everything else, the ACH files and the check volume and a paused cash scenario, got nothing, and nothing in the objective objected. There was no balancing term. The flat cost paradigm was, if anything, a term pulling the other way.
The analogy breaks at one important point, and it is worth being plain about it. A gating network drifts into collapse by gradient descent; nobody decides it. TD's coverage was a decision. It was documented, budgeted and written up in a self-assessment as an accomplishment. That makes the bank's case worse, not better. It also makes the lesson easier to use, because a decision can be reviewed in a way that a gradient can't.
The question this case leaves anyone deploying detection at scale, whether a fraud model, a SIEM, a content filter or an anomaly detector on your payments, is usually asked like this: is your model catching the crime, or catching the cases that are cheapest to flag?
TD's record says to ask a harder one first. What share of your volume reaches any detector at all? A model can have excellent precision and recall on the traffic it sees and still miss nearly everything, if what it sees is 8 percent of what happens. Alert counts, backlog age, true-positive rates and cost per investigation all describe the queue. None of them describes the part of the business that never enters it.
Four habits carry over from the consent order to your own systems.
Report coverage as a first-class number. Keep a running figure for the share of events, by type and by value, that pass through any detection at all, and list the uncovered types by name. The mechanics are small. Have every detector stamp the events it evaluated, then count each event type's stamped share against its total, once by count and once by value. TD's two numbers, 92 percent of volume and 74 percent of value, needed both counts to say what they say. When a new event type shows up with no stamps, that is a finding in itself: nobody is watching it yet. TD's regulators computed its coverage after the fact. You can compute yours now.
Give every paused rule an owner and an end date. A disabled detection rule is a feature flag, and it deserves the hygiene you give feature flags. A scenario switched off "temporarily" should turn itself back on, or page a named person, when its date passes. The one that would have flagged Customer Group A stayed dormant for a decade because nobody's calendar said otherwise.
Add a balancing term to how the program is graded. If your detection team is measured on cost, alert volume or closure time, add a measure that punishes uneven attention: coverage by segment, review effort per segment, time since a segment was last tested. A simple version is investigator minutes per million dollars of flow, by segment. A segment reading zero is a segment you have decided not to look at, whether or not anyone decided it on purpose. That is the importance loss, translated into a scorecard.
Treat the backlog as a symptom. A growing queue tells you the people are short. It says nothing about what the system never looked at, and the regulators' number is built on the part it never looked at.
TD's AML leaders were right that they had kept the program within a flat cost paradigm. The record shows that cost was the only thing the program had been asked to hold still. What never showed up on anyone's dashboard was everything it wasn't looking at.
TD's regulators had to reconstruct, years later, which transactions its monitoring had ever evaluated. The cheapest fix is the one in the checklist above: every detector stamps what it looked at. If your detectors or agents make decisions, Chain of Consciousness keeps a tamper-evident record of what each one evaluated and when, so coverage is a number you can read, not one a regulator computes after the fact.
pip install chain-of-consciousness npm install chain-of-consciousness
Or start without installing anything: Hosted Chain of Consciousness.