I spent twenty years in anti-money-laundering compliance at one of the big American banks. I will not say which, because it does not matter which; we all run the same machine, and this week it was Bank of America’s turn to open the hood, so let us use theirs. On Tuesday, just after the market closed, Bank of America was penalized more than $1.2 billion by the United States government. Not as an accusation. As an admission. The bank agreed, in writing, that it had willfully failed to report more than $5 billion in suspicious transactions, over a billion of it tied by the Treasury to Chinese money-laundering networks and the southwest border. Willfully. The regulator chose the word and the bank signed beneath it. And then, because nothing in my profession is ever quite as damning as it first appears, a footnote explained what “willfully” means here. It means “reckless disregard or willful blindness.” Not that they meant to. That they arranged not to look. Which is, if you read the whole 64 pages, the single most honest sentence in the document. Bank of America reported its quarterly earnings the next morning. Hold those two facts side by side, because they are not a contradiction. They are a schedule. You do not drop a billion-dollar penalty the evening before earnings by accident. You do it the way you book a root canal for a day you were taking off anyway. One news cycle of pain, folded into one news cycle of profit, and by lunch the stock has decided it feels fine. The analysts had a phrase for it. They called it “clearing an overhang.” An overhang is what my industry calls a crime once it has been successfully priced. Here is the sentence they train you never to say, and I am long past the building, so I’ll say it. To a bank this size, a fine is not a punishment. A fine is a fee. The $1.2 billion is about two weeks of this bank’s profit. Two weeks. You do not deter a man by charging him a fortnight. You invoice him, and he pays, because his credit is, and I mean this with professional admiration, excellent. Now let me show you how the crime is actually committed, and here is the part that changed my life, so attend. I used to have to tell people how the dial worked. I would describe it and they would squint, because it sounded too cynical to be real. I don’t have to describe it anymore. The bank described it. Under oath. The machine watches transactions and raises its hand when one looks suspicious. Each raised hand is an alert; alerts are scored; a bundle of them reaches an actual human being only when the score crosses a threshold. And that threshold, the single number that decides how much crime the bank is permitted to notice, was, in the words of the order, “initially set by stakeholder judgment.” Stakeholder judgment. A man picked a number. Alerts older than thirteen months were “retired,” which is a beautiful word for a suspicious transaction the bank has decided to let die of old age. You tune the dial. And you do not tune it to the amount of crime. You tune it to the number of people you’ve hired to read the alerts. I can prove this now, which is new. In 2022 the bank ran its own test. It found that if it loosened the threshold, it would catch suspicious activity 85.4 percent of the time instead of 20.2 percent. Four times the crime, caught, by the bank’s own math. And it declined. In writing. The reason it gave, and I want you to hold this the way you’d hold something still warm, was that the additional cases “may exhaust the investigation resources.” Read that again. They did the test. The test said: you are catching one in five, and you could catch four in five. And the bank wrote down that catching four in five would be too much work. Not too expensive to be worth it. Too much work. The crime was findable. They measured exactly how findable. And they filed the measurement under reasons not to look. It gets better, by which I mean worse. A year later an internal test came back with a number somebody upstairs didn’t like. So, per the order, the Global Head of Financial Crimes “directed a senior manager to repeat the test.” They ran it again. The second time it produced, and this is the regulator’s phrasing, “a more favorable result,” after which the team declared itself “confident that EP is working as intended.” When the test told the truth, they ran it again until it lied. Then they wrote that the system was working as intended. It was. That was the problem. And they had a term, an actual line item, for the suspicious activity they chose to stop catching. When they recalibrated the dial in 2021 and cut eight thousand cases, the order notes the resulting loss of filed reports was called “SAR loss,” and deemed “permissible.” Two words, side by side, in a real document kept by a real bank: a loss, and permission. Nobody ever wrote down who it was permissible for. Let me give you the detail I think about on the lake, now, in retirement, when I am supposed to be fishing. A SAR, a suspicious activity report, is the thing a bank files when it has reason to suspect dirty money. For foreign banks, the ones most likely to be moving a cartel’s cash, you keep a due-diligence file. The file is the whole point. The file is the thing that is supposed to tell you whether you are helping launder the proceeds of murder. And the order records that these files “often consisted of” graphs. Of the bank’s own stock price. That was the file. A chart of us, getting richer, going up and to the right. Someone opened the folder that is meant to say is this foreign institution dangerous, and inside was a picture of our share price. The diligence was a mirror. I have never read anything truer about the industry, and I helped build it. You want to know how it ends up like this. It ends up like this in meetings, and the meetings are in the record too. Compliance flags a client, a hundred cases, overwhelming evidence of scam-victim money flowing in, and you can feel the officer’s human heart in the file, because he types, verbatim, “YESSSSSSSSSSSS.” Finally. We caught one. And the business line, the people who own the revenue, write back that “a closure here would be detrimental given the impact of this relationship.” And the recommendation to close the account is withdrawn, in favor of a “mitigation plan,” and the mitigation plan, I am not inventing this, includes asking the client to take its account number off its website. The client kept taking the victims’ money for another year. The bank’s stated corporate philosophy, printed on the walls, is “Responsible Growth.” The growth was responsible. To the revenue. That is the only constituency the word was ever pointed at. Now. You think this is new. It isn’t new. It’s only documented now, which is different, and I’d like to take you through the family album, because a profession should know its saints. At HSBC the Sinaloa cartel’s cash came through the teller windows in boxes. Not ordinary boxes. Boxes, per the record, “measured to slide neatly under the teller windows.” Sit with the carpentry of that. Someone measured the window. The laundering was so routine, so expected, so built into the furniture, that the criminals manufactured cash boxes to a tolerance spec, like a part. HSBC paid $1.9 billion, about five weeks of profit, and not one executive went to prison, and a United States Attorney General stood up in the Senate and admitted, out loud, that some banks had become “so large” that prosecuting them was “difficult,” because it might harm the economy. Too big to jail. Not my phrase. The government’s confession, offered freely, under the lights. A senator asked the obvious question at the time, and it has never been answered, so I’ll leave it with you the way she left it: how many billions do you have to launder for drug lords before someone shuts the bank down? And then she answered it herself. If you’re caught with an ounce of cocaine, you go to jail. Launder a billion for the men who sell it, and your company pays a fee and you go home and sleep in your own bed. At TD Bank, more recently, they left eighteen trillion dollars in transactions unmonitored, because of a budget rule they called, internally, the “flat cost paradigm,” which is the dial, promoted to a company value. And the launderers, who chose TD because, in one employee’s words, “we are convenient,” paid a bank employee for his help. Not in cash. In gift cards. Fifty-seven thousand dollars in gift cards. The price of an American bank’s conscience, it turns out, is a stack of plastic you redeem at the mall. And the whole apparatus, the $206 billion a year the world spends on compliance, the thousands of us with our titles and our attestations, catches, by the United Nations’ own estimate, about 0.2 percent of the money it exists to stop. One five-hundredth. I want to be clear that this is not a failure. A thing that performs at the identical level for decades is not failing. It is functioning. 0.2 percent is the spec. We hit it every year. We would catch more, but it may exhaust the investigation resources. So what was I, in all this? I had a title with the word “integrity” in it, and I have come to understand what that title is for. There is no Department of Honesty. You only name a role after the thing the building does not contain. I was the crumple zone. I was the part engineered, at great salary, to sit at the precise coordinate where the blame arrives, so that it stops at me and does not continue up the stairs to the people who set the revenue targets that required the dial. The blame comes down like water, past everyone who decided, and it pools at the lowest officer who signed something, and that officer was me, and we called it accountability and I called it a pension. Here is the number I cannot put down, the one the order gives you at the very end, after all the rest. When they were finally forced to fix the dial, to turn it back to where it should have been, it required seven hundred and fifty new staff, plus eight hundred consultants, and it doubled the monthly caseload. And FinCEN calculated that by not doing this, by keeping the dial where it was, the bank had “likely saved hundreds of millions of dollars.” So we know, now, exactly what it would have cost to see clearly. Seven hundred and fifty people. They existed. They were hireable. The bank could have afforded them the way you can afford lunch. The conscience was never too expensive. It was itemized, and compared against the fine, and the fine came out cheaper, and two weeks of profit is a very reasonable price for twenty years of not looking. This is the bank’s second order for the same failure. The last one, two years ago, carried no penalty, and in between the two the bank told its shareholders the whole thing would have “no material adverse financial impact.” The new one comes with a mandatory “lookback,” “independent reviews,” and the regulator’s explicitly reserved right to fine them again. That is not a punishment. A punishment ends. This is a subscription. It renews. The relationship between a bank this size and its regulator was never cop and criminal. It is landlord and tenant, and the fine is the rent, paid on a schedule, for the right to keep living in a building you are slowly, profitably, burning down. The Treasury Secretary said even the biggest institutions are not above the law. He’s right. They’re not above it. They’re downstream of it, which is a far better address. Above the law you’re exposed; the weather finds you. Downstream, you simply wait, and everything the law was built to stop flows gently down to you, having first been measured, scored, retired, rescored, risk-accepted, declared permissible, and cleared by Friday. I’m retired now. I have the pension, and the lake house, and a conscience I keep in a drawer with the attestations. The bank says it is committed to doing better. I believe it. It’s in the budget. Right next to the fine, which was cheaper.