TD Bank's Years of Missed Warnings & Failed Controls

Key Takeaways

• A New Guilty Plea: A former TD Bank employee pleaded guilty in October 2026 to laundering-related charges and accepting bribes after helping move more than $4.8 million to Colombia through accounts and debit cards.
• Nearly a Decade of Monitoring Failures: TD made no material changes to its transaction-monitoring scenarios from at least 2014 through late 2022, despite repeated warnings and changes in its business.
• Trillions Outside Automated Monitoring: Approximately $18.3 trillion in transaction volume, representing 92% of TD’s total volume between January 2018 and April 2024, was not covered by automated monitoring.
• Billions in Penalties and Operating Restrictions: TD’s 2024 criminal and regulatory settlements resulted in approximately $3.09 billion in penalties, independent oversight, and a $434 billion asset cap on its U.S. banking subsidiaries.
• Remediation Extends Into 2027: TD increased its fiscal 2026 U.S. anti-money-laundering remediation and related spending estimate to $550 million, with historical reviews and independent validation continuing.

Deep Dive

From April 2022 to November 2023, according to federal prosecutors, a TD Bank employee in Florida opened fraudulent accounts and issued hundreds of debit cards to co-conspirators. When the bank restricted some of the cards over possible fraud, he unblocked them. About $4.8 million left the United States for Colombia through the accounts and cards. Eighty-six of the accounts used the same commercial address in Miami and carried more than $3 million of that total. He took more than $8,000 in bribes, paid in cash and through a peer-to-peer payment app.

He pleaded guilty on October 6 to conspiring to launder monetary instruments and to receipt of bribes by a bank employee, charges that carry maximum sentences of 20 and 30 years. Sentencing is set for March 23, 2027. The plea resolves charges against the individual only. The Justice Department’s announcement does not say who received the money in Colombia, and it does not connect him to the networks described in TD’s own 2024 criminal resolution. One of those networks, though, worked the same way. It deposited money in the United States and withdrew it at ATMs in Colombia, with help from five TD employees who issued dozens of ATM cards in a conspiracy involving about $39 million. By April 2022, when the conduct in the new case began, the Justice Department says TD’s transaction-monitoring program had been effectively static for more than eight years.

The statement of facts TD agreed to in 2024 covers January 2014 through October 2023. Over that period, senior executives enforced a budget mandate known internally as the “flat cost paradigm,” under which TD’s budget could not rise from one year to the next even as its profits and risk profile grew significantly. Anti-money-laundering projects were postponed or canceled, and the Justice Department says the bank put cost and the customer experience ahead of repairing the program. Federal regulators and TD’s own internal audit group repeatedly raised concerns about transaction monitoring. The program nonetheless contained enough elements to look adequate on paper.

Monitoring runs on scenarios, rules that decide which activity reaches a human investigator, and they go stale as products and criminal methods change. TD added no new scenarios and made no material changes to its existing ones from at least 2014 through late 2022. FinCEN’s consent order says the gaps were older than that. It found that TD had known since at least 2012 that it did not monitor virtually any domestic ACH activity, and that its system lacked the transaction codes needed to monitor 98 percent of domestic ACH transactions.

The Justice Department’s account is that the exclusions were intentional. TD did not automatically monitor all domestic ACH transactions, most check activity and numerous other transaction types, so 92 percent of total transaction volume, about $18.3 trillion, went unmonitored between January 1, 2018, and April 12, 2024. The figure measures activity outside the automated system. It is not the amount laundered, and it does not mean no person ever saw a transaction in those categories. New products arrived without matching coverage. FinCEN found that TD never built scenarios specific to Zelle and instead relied on ones designed for other products, including wires, which ACAMS summarized the agency as judging unfit for the purpose.

Other failures sat outside the software. TD did not meaningfully monitor certain transactions involving high-risk countries, and its stores were told to stop filing internal unusual-transaction reports on some suspicious customers. More than $5 billion in transactions moved through accounts after the bank had decided to close them. The Justice Department’s summary does not explain how that happened.

The department says the bank knew. Attorney General Merrick Garland said TD admitted that at various times high-level executives, including the person who later became its chief anti-money-laundering officer, knew of serious problems in the program. FinCEN attributed the bank’s lack of a fully functional monitoring system for nearly a decade to consistent underinvestment in staff and technology, and the OCC found that the bank repeatedly failed to take timely corrective action. None of this is an allegation that every executive knew of every scheme, and the government did not make one.

What Came Through

Three networks moved more than $670 million through TD accounts between 2019 and 2023. The first, between January 2018 and February 2021, put more than $470 million through nominee accounts by way of large cash deposits. Its operators gave employees gift cards worth more than $57,000 to keep their transactions processing. Employees left the person conducting the deposits off the required reports, though the cash amounts ran well past the $10,000 reporting threshold. The second was a high-risk jewelry business that moved nearly $120 million through shell accounts between March 2021 and March 2023 before TD reported the activity. The third was the Colombia ATM network, one of whose schemes, according to the U.S. Attorney for New Jersey, allegedly withdrew from ATMs at 40 to 50 times the daily limit for personal accounts. More than two dozen people have been charged across the schemes, including two bank insiders.

TD marketed itself as “America’s Most Convenient Bank,” and the statement of facts shows employees turning the slogan into a joke about who banked there. In an October 2021 exchange, an anti-money-laundering technologist asked a manager what the bad guys made of TD. The manager called the bank an easy target, according to the statement of facts as quoted by the Justice Department. A fuller version of the exchange, reported by ACAMS, has the manager pointing to old scenarios and slow technology. FinCEN separately found that TD failed to file suspicious activity reports on thousands of suspicious transactions totaling about $1.5 billion.

The October plea describes the same kind of exposure, an employee able to open accounts, issue cards and lift restrictions the bank itself had imposed.

The Plea and What Followed

On October 10, 2024, TD Bank pleaded guilty to conspiring to fail to maintain a Bank Secrecy Act compliant anti-money-laundering program, to fail to file accurate currency transaction reports, and to launder money. Its U.S. parent pleaded guilty to causing the bank to fail to maintain such a program and to file accurate reports. The Justice Department called TD the largest bank in U.S. history to plead guilty to Bank Secrecy Act program failures and the first U.S. bank to plead guilty to conspiracy to commit money laundering. Its penalty, a $1,434,513,478.40 fine plus $452,432,302 in forfeiture, came with a 20 percent reduction for partial cooperation. The department said TD had not voluntarily disclosed its misconduct and had failed to escalate relevant concerns promptly during the investigation. Garland said it was the first time the department had assessed a daily fine against a bank.

FinCEN imposed a $1.3 billion civil penalty, with $543 million in payments to the Justice Department and the OCC credited against it. The OCC issued a cease-and-desist order and a $450 million penalty, and the Federal Reserve fined the parent $123.5 million. Net of credits, the combined penalties come to about $3.09 billion. The Justice Department required an independent compliance monitor for three years, and FinCEN’s monitorship runs four.

The OCC also capped TD’s U.S. retail banks at the combined assets they reported on September 30, 2024, about $434 billion, for as long as the order stands. TD estimated the cap would cost it $200 million to $225 million in net interest income in 2025 and planned to shed about $50 billion in lower-yielding securities. The order also requires TD’s board to certify to the OCC how it is allocating resources to comply, and it allows further restrictions if noncompliance continues. For a bank accused of holding its budget flat, a regulator now audits the budget.

On leadership, TD moved CEO Raymond Chun’s start date from April 10 to February 1, 2025, replacing Bharat Masrani, who had led the bank since 2014. Masrani received no incentive pay for 2024, and TD said his total direct compensation fell 89 percent, from $9.2 million (C$13.3 million) to $1 million (C$1.5 million). TD reduced the variable compensation of 41 current and former executives by $20.9 million (C$30 million), according to its shareholder letter, and five directors were set to retire. The bank said it acknowledged responsibility for the failures in its U.S. program.

Remediation

In its third-quarter report, released August 27, TD said it expects about $550 million in pretax U.S. anti-money-laundering remediation and related governance and control investments in fiscal 2026, up from earlier guidance of $500 million. It attributed the increase to the cost of the lookback reviews. The documents I reviewed do not say what TD spent annually on these controls from 2014 to 2023, so the new figures have no baseline.

The work is not finished, though. TD expects to complete the suspicious-activity lookback required by the OCC order in calendar 2027. All of its remediation actions remain subject to validation by internal audit, review by the monitor, and approval by U.S. regulators and the Justice Department. In Canada, the Financial Transactions and Reports Analysis Centre began a review in early 2025 of steps TD took to address violations the agency had found, and TD says that review is ongoing. TD has told investors that independent testing could produce additional remediation after 2027, and that the lookbacks themselves could widen in scope or in the period they cover.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey