An AML lookback is a retrospective review of a financial institution’s past transactions to find suspicious activity that its monitoring systems failed to catch the first time. A regulator usually orders one after finding serious gaps in the institution’s Bank Secrecy Act compliance program, though banks sometimes launch lookbacks on their own after discovering a monitoring failure. The review typically covers one to five years of historical data, results in previously missed Suspicious Activity Reports being filed with FinCEN, and forces permanent changes to the controls that let the activity slip through. Willful BSA violations can carry criminal fines of up to $250,000 and five years in prison per offense, so the stakes behind a lookback are real.
What Triggers a Lookback
Most lookbacks begin with a formal enforcement action. When FinCEN, the OCC, the Federal Reserve, or the FDIC finds serious weaknesses in a bank’s compliance program, the resulting consent order or cease-and-desist order typically names a lookback as one of the required remediation steps. The 2024 OCC consent order against TD Bank required the bank to hire an independent consultant and conduct a full SAR lookback across its entire customer base, covering years of transaction data.
Institutions also initiate lookbacks without being ordered to. Common self-triggers include:
- A transaction-monitoring failure, such as a coding error, an overly narrow filter, or missing rule logic that went undetected for months or years, forcing the bank to re-screen every transaction the system should have caught.
- A merger or acquisition, since acquiring another institution means inheriting its compliance history, and a lookback on the acquired entity’s transaction history is standard where its controls or risk profile differed.
- Internal audit findings that show certain account types, business lines, or geographic corridors were inadequately monitored, prompting a targeted retrospective review.
The common thread is a realized gap between what monitoring should have caught and what it did catch. The longer the gap sat open, the larger and more expensive the lookback becomes.
Setting the Scope and the Review Window
The first real decision is how far back to go and what to look at. No single regulation fixes a lookback period. The window depends on the nature of the failure, when it started, and what the regulator demands, and in practice periods usually run one to five years. The ceiling is shaped partly by BSA record-retention rules, which require banks to keep most records, including SARs, CTRs, and supporting documentation, for at least five years from the filing date. Customer identification records must be kept for five years after the account closes. If records no longer exist, a lookback for that period becomes impossible in practice, though the absence of records can itself raise regulatory concerns.
Within the chosen window, the team pulls together several categories of data:
- Customer due diligence files, including identification records, beneficial ownership information, and risk profiles. Federal rules require institutions to identify anyone owning 25 percent or more of a legal entity customer and to maintain ongoing customer risk profiles.
- Wire and ACH records showing the origin, destination, amount, and timing of every movement of funds.
- Currency Transaction Reports. Banks must file a CTR for any cash transaction over $10,000, including multiple cash transactions by the same person that together exceed $10,000 in a single business day.
- Prior SARs and the investigation notes behind them, so the team can assess whether the original analysis was adequate.
Getting this data into usable shape is often the most time-consuming phase. Legacy systems store information in different formats, older records may be only partially digitized, and data fields from acquired institutions rarely map cleanly onto the parent bank’s systems. The quality of this preparation directly determines whether the screening that follows will be reliable or will drown analysts in false positives.
How the Retrospective Analysis Works
Once the data is organized, the team applies transaction-monitoring rules designed to flag patterns the original system missed: rapid movement of large sums, transactions with high-risk countries, round-dollar transfers without a clear business purpose, and structuring. Structuring occurs when someone deliberately breaks transactions into smaller amounts to stay below the $10,000 CTR threshold, and FinCEN has identified this as a pattern institutions must be equipped to detect.
The screening generates alerts, and every alert needs a human decision. Analysts triage by risk level, then investigate each flagged account individually. That means reviewing the customer’s known business profile, comparing flagged transactions against invoices or contracts on file, and checking whether prior communications explain the activity. The goal is to decide whether each transaction has a legitimate business purpose or looks suspicious in context.
Clearing false positives takes up a large share of the work. Unusual activity is not automatically suspicious. A seasonal business depositing large sums in December, or a real estate closing generating a spike in wire activity, may look alarming to an algorithm but makes sense once you check the profile. The analyst documents why each alert was escalated or dismissed, creating an audit trail regulators can examine later. When an alert survives review and the analyst cannot identify a lawful explanation, the case moves to reporting.
The Independent Consultant Requirement
Regulators rarely trust the institution to grade its own homework. Consent orders typically require the bank to hire an independent, third-party consultant with demonstrated BSA/AML expertise to conduct or oversee the lookback. The OCC’s consent order against TD Bank required the bank to submit the consultant’s name, qualifications, and engagement terms for regulatory approval before work could begin.
Independence standards are strict. Under FFIEC guidance, whoever performs the testing cannot also be involved in building the institution’s policies, procedures, or training materials, since reviewing your own work defeats the purpose. The testing party reports findings directly to the board of directors or a board committee composed primarily of outside directors. Examiners evaluate whether the person conducting the review has adequate subject matter expertise and genuine independence from the compliance functions being assessed.
The consultant’s final written report must detail the analytical methods used, the number and types of accounts reviewed, any SARs recommended for filing, and any cases where the bank disagreed with the recommendation. That report goes directly to the regulator.
Filing the Missed SARs
When the lookback identifies transactions that should have been reported, the institution files SARs with FinCEN. Banks must file a SAR for any suspicious transaction involving $5,000 or more in funds. The standard deadline is 30 calendar days from the date the institution first detects facts that may warrant a report. If no suspect has been identified at that point, the institution gets an additional 30 days, but filing cannot be delayed beyond 60 calendar days from initial detection.
Lookback SAR narratives should explain the context: that the activity surfaced during a retrospective review, what compliance gap led to the original failure, and the specific dates the suspicious activity occurred. Regulators read these narratives closely because they reveal both the suspicious activity and the monitoring failure that missed it.
Beyond individual SARs, the institution produces a comprehensive summary report documenting the entire lookback: the scope, the filtering rules and thresholds applied, the number of alerts generated and dispositioned, the remediation steps taken, and a detailed accounting of every SAR filed or recommended. Regulators use this summary to decide whether the terms of the consent order or internal mandate have been satisfied.
Safe Harbor for the Institution Filing Late SARs
A common worry during a lookback is whether filing a batch of previously missed SARs invites lawsuits from the customers named in them. Federal law addresses this directly. Under 31 U.S.C. ยง 5318(g)(3), a financial institution that voluntarily discloses a possible violation of law to a government agency, or files a SAR under any authority, is protected from civil liability. No customer, business partner, or other party named can sue the institution or any individual employee who made or required the filing. The protection covers claims under federal law, state law, and private contracts, including arbitration agreements.
The safe harbor does not shield the institution from government enforcement. Regulators can still pursue civil or criminal penalties for the underlying compliance failures that made the lookback necessary.
Penalties Behind the Original Failure
The penalty structure for BSA violations runs on two tracks. Civil money penalties depend on whether the violation was negligent or willful. For negligent violations, FinCEN can impose up to $500 per violation, with an additional penalty of up to $50,000 for a pattern of negligent activity. Willful violations carry up to the greater of $100,000 or $25,000 per violation. Repeat violators face enhanced penalties of up to three times the profit gained or two times the maximum penalty, whichever is greater.
Criminal exposure is heavier. Willful BSA reporting violations can result in fines of up to $250,000 and imprisonment of up to five years. If the violation is part of a pattern of illegal activity involving more than $100,000 in a 12-month period, the maximum fine doubles to $500,000 and the prison term doubles to 10 years. Courts can order convicted individuals to forfeit profits from the violation, and officers or employees may be required to repay any bonuses received during the year of the violation or the year after.
The general federal statute of limitations for civil penalty actions is five years from the date the claim first accrued, which aligns with BSA record-retention periods. Criminal prosecutions run on their own timelines, and certain fraud-related offenses can extend beyond the standard limitations period.
What a Lookback Costs
Lookbacks are expensive, and institutions that have never been through one tend to underestimate the cost. The expense falls into three categories: external consultants, internal staff reallocation, and technology.
Independent BSA/AML consultants typically bill between $150 and $450 per hour depending on seniority and complexity. A small lookback covering a narrow set of accounts over a short window might cost in the low six figures. Large-scale lookbacks ordered by regulators against major institutions can run into tens of millions of dollars. The TD Bank consent order required a lookback across the bank’s entire customer base spanning years of activity, an engagement that dwarfs a routine compliance review.
Internal costs are easier to overlook. The lookback pulls compliance officers, data engineers, and line-of-business managers away from their normal responsibilities for months. Institutions often need to license additional screening software or expand server capacity to handle historical data. Planning for these demands as soon as the triggering event is identified prevents the project from stalling midway through when budgets run dry or key staff burn out.
What Happens After the Report Is Delivered
Filing the SARs and delivering the summary report does not end the institution’s obligations. Regulators expect lookback findings to drive permanent changes to the compliance program. The consent order against TD Bank required the bank to implement ongoing, risk-based independent validation of its monitoring models, rules, thresholds, and filters to ensure all accounts and transactions are captured going forward.
Post-lookback remediation typically involves recalibrating transaction-monitoring rules based on the patterns the review uncovered, retraining staff on the activity that was previously missed, updating customer risk profiles across the portfolio, and establishing a validation schedule to periodically test whether the new controls are working. Regulators continue examining the compliance program with heightened scrutiny, often for several years after the lookback concludes. The institution remains under the consent order until the regulator is satisfied the remediation is complete and sustainable, and premature requests to lift the order rarely succeed.