My Bank Says the Issue Was “Human Error” but It Keeps Happening

A bank may describe a missed alert, late escalation or incomplete record as “human error”. Sometimes that is accurate: a person made an isolated mistake, the bank found it, corrected it and addressed the cause. But when the same control failure recurs, affects similar transactions or survives repeated warnings, the important question changes. It is no longer only what went wrong? It is also what did the organisation know, when did it know it, and what did it do next?

For AML professionals, the distinction between a one-off error and a pattern of failures can matter to internal escalation, regulatory scrutiny and, in some circumstances, a whistleblower disclosure. Repetition alone does not prove a Bank Secrecy Act (BSA) violation or deliberate misconduct. It can, however, be evidence that a control is not working—or that decision-makers have been put on notice and have failed to respond.

This article is general information about US law, not legal advice. The BSA, whistleblower protections and filing deadlines are technical, and the right route depends on your role, the facts and the date of any retaliation. Get advice promptly if you are considering a disclosure or believe you are being penalised for raising concerns.

Pattern vs error: what separates a mistake from a potential BSA problem?

The BSA and its implementing regulations require covered financial institutions to maintain AML programmes and meet particular obligations, which can include keeping records, monitoring for suspicious activity and filing Suspicious Activity Reports (SARs) when the applicable legal standard is met. An operational defect may be relevant to those obligations, but an employee’s mistake does not automatically establish that the bank violated the law. Nor does every missed alert mean a SAR was legally required.

A useful starting distinction is:

Human error: an isolated oversight, such as an analyst selecting the wrong disposition, followed by prompt detection, correction, appropriate escalation and a credible response to the underlying cause.
Control failure: a process, system or staffing weakness that repeatedly prevents the bank from identifying, investigating or escalating activity as intended. This may raise serious compliance concerns even if no one set out to break the law.
Potentially deliberate misconduct: facts suggesting someone knowingly bypassed a control, suppressed an escalation, altered a record or directed staff not to document or report a concern. Those facts require careful investigation; they should not be asserted without evidence.

In practice, the difference between an error and a concerning pattern is often visible in the details. Did similar cases recur after the issue was raised? Were the same product, branch, customer type, alert rule or workflow involved? Did a manager receive a dated escalation? Was a remediation plan approved, and did it actually fix the problem? Were staff told to close alerts without adequate review, or did a system outage simply go unnoticed and get promptly corrected?

Look at both outcomes and responses. A repeated defect may point to weak training, unrealistic workloads, flawed thresholds or a poorly configured system. These are not, by themselves, proof of intent. More concerning intent indicators may include instructions to avoid creating a written record, knowingly changing a case narrative to conceal a material fact, overriding an alert without a stated rationale, or continuing a practice after specific warnings and a documented assessment of the risk. Context matters: an override can be legitimate, and a badly worded message is not conclusive evidence of a cover-up.

What to write down: evidence that can withstand scrutiny

Good documentation is factual, contemporaneous and proportionate. You do not need to make a legal case in your notes. You do need to make it possible for someone independent sanctions screening failure reporting to understand what happened, when it happened and what you personally observed.

Build a dated record

For each relevant event, record the date and time, the system or process involved, what you observed, what action you took and who received the escalation. Identify whether a statement is a direct observation, something another person told you, or your own inference. For example, write “On 14 March, I escalated alert 4821 to the team lead; the case was returned with the instruction ‘close—no further review’” rather than “management is hiding suspicious activity”.

Where policy permits, note a case or alert reference rather than copying customer information into personal notes. A SAR and information that would reveal its existence are subject to strict confidentiality requirements. Do not take customer data, SAR material, internal files or other confidential information to a personal account or device. Ask a lawyer how to preserve relevant evidence lawfully, especially if company policies, privacy rules or information-security controls apply.

Use a simple evidence checklist

Dates and identifiers: dates of alerts, reviews, escalations and remediation; case numbers or system references where permitted.
What happened: the control expected to operate, the step that failed and the impact you observed or can substantiate.
Repeat pattern: how many similar events you personally know about, over what period and what features they share. Avoid estimates presented as confirmed totals.
Notice and response: who was told, when, through which channel, and what response or follow-up occurred.
Source and limits: distinguish first-hand knowledge from reports by others; note when you do not know whether a SAR was filed or what the bank’s legal assessment was.
Human error versus intent: record plausible operational explanations as well as facts that may point to knowing conduct. Do not infer motive from repetition alone.

Keep a factual timeline and retain documents only through authorised channels. If you are asked to alter, backdate or destroy a record, document the request as accurately as you can and seek legal advice before taking further steps. Do not secretly record conversations unless a lawyer has confirmed the recording is lawful where you are.

Use the FFIEC materials to understand the control context

The Federal Financial Institutions Examination Council (FFIEC) publishes examination resources, including the BSA/AML Examination Manual, at ffiec.gov. These materials can help professionals understand how examiners assess areas such as AML programme governance, suspicious activity monitoring and reporting, and internal controls.

Use the manual as a reference point, not as a verdict on your employer. Examination guidance can help you identify which control or obligation may be relevant, but it does not Visit this website establish that a particular bank broke the law. The specific facts, applicable regulations, the institution’s circumstances and the evidence all matter. When documenting a concern, identify the actual control or requirement you believe is implicated; avoid relying on broad labels such as “systemic failure” without explaining the underlying events.

Timing pressure: limitations periods can be short

Do not assume you can wait until an internal review concludes. Different claims and reporting routes may have different deadlines, and a company investigation or compliance hotline submission does not necessarily pause a legal limitation period.

The AML whistleblower provisions in 31 U.S.C. § 5323 include anti-retaliation protections and a process for pursuing a retaliation claim. The statute contains timing requirements, and the applicable deadline and procedure can depend on the claim and its procedural history. Other possible protections—such as employment, state-law or other federal claims—may have different filing deadlines, notice requirements and exhaustion steps. A deadline may run from a particular employment action or from when you knew, or should have known, of it; do not assume the clock starts only when the dispute is resolved.

The National Law Review has published an overview of filing an AML/BSA whistleblower lawsuit: National Law Review. Read it as general background, not as a substitute for current statutory guidance or advice on your facts. If you are weighing a disclosure, retaliation has already occurred, or you have been threatened with discipline, speak to a lawyer experienced in whistleblower and financial-regulatory matters as soon as possible. Bring a dated timeline and ask specifically about deadlines, protected channels, confidentiality and preservation of evidence.

Anonymous vs identified submissions

“Anonymous” can mean different things: an internal hotline submission without your name, a regulator tip submitted through a representative, or a disclosure where the recipient knows your identity but agrees to protect it subject to legal limits. These options are not interchangeable. A regulator may need follow-up information, and anonymity can make it harder to clarify facts or establish your own role. Confidentiality is not an absolute guarantee that identity will never be disclosed—for example, legal proceedings may create disclosure issues.

Some whistleblower programmes permit anonymous submissions through an attorney, subject to their rules and the steps needed to verify the whistleblower’s identity. Whether that route is available, and whether it applies to a particular BSA/AML disclosure or potential award, must be checked against the current programme requirements. Do not assume that an ordinary email to a regulator is an eligible anonymous award submission.

An identified disclosure can make follow-up easier and may help establish that you engaged in protected activity, but it can also expose you to workplace pressure. Before choosing, consider:

Which body or channel is appropriate for the concern, and whether it accepts anonymous information.
Whether the process requires an attorney, a signed declaration or later identity verification.
How the recipient may contact you for supporting details.
Whether your concern involves SAR confidentiality, customer data or privileged material.
What internal retaliation risks exist, and how you will document any adverse treatment.

Do not promise yourself complete anonymity, and do not identify colleagues or customers unnecessarily. A lawyer can help select a channel and explain the limits of confidentiality before you submit sensitive information.

Raising the issue without overstating it

A credible escalation is specific, measured and clear about what you do not know. Separate the observed event from your interpretation. For example: “I observed four alerts with the same documented review gap between 3 February and 19 March. I escalated two through the case system on 6 February and 11 March. I do not know whether a SAR was filed. The issue appears to persist after the remediation date recorded in the team tracker.” That is more useful—and fairer—than alleging that a manager deliberately enabled money laundering without evidence.

Consider retaliation risk before using an internal channel. Review the bank’s policies, identify any confidentiality limits and, where appropriate, obtain independent legal advice first. Keep a dated record of your own work-related communications and any changes to your duties, access, reviews or performance treatment after raising a concern. A negative action is not automatically retaliation, just as a complaint is not automatically protected; the sequence, reason and applicable law matter.

The practical test

When a bank calls a recurring issue “human error”, ask three questions: What exactly happened, how often and when? Who was told, and what changed afterwards? What evidence distinguishes a remediated mistake from a known control failure or possible intentional override? A pattern deserves careful attention, but repetition is a starting point for investigation—not proof of intent. Record facts with dates, protect confidential information, distinguish what you know from what you suspect, and get timely advice before a filing deadline or workplace decision narrows your options.