Beyond the Fine: What the Merrill Lynch SAR Failure Means for Compliance Officers in Nigeria and Africa

The SEC’s $7.5 million penalty against Merrill Lynch offers valuable lessons for compliance professionals across Nigeria and Africa, highlighting why effective transaction monitoring, governance and timely suspicious transaction reporting are regulatory imperatives. Tamuno Gobiri posits….

When the U.S. Securities and Exchange Commission (SEC) fined Merrill Lynch $7.5 million for failing to investigate suspicious transaction alerts and file Suspicious Activity Reports (SARs), the enforcement action resonated far beyond the United States. For compliance officers in Nigeria and across Africa, it serves as a timely reminder that regulators are no longer satisfied with institutions merely having Anti-Money Laundering (AML) systems. They expect those systems to work.

The Merrill Lynch case illustrates a common compliance challenge. The firm had an automated transaction monitoring system capable of detecting suspicious activity. However, its alert thresholds prevented many lower-risk alerts from being reviewed, even though internal assessments suggested that several should have resulted in SAR filings. In the eyes of the regulator, the failure was not technological, it was one of governance, oversight and risk management.

This lesson is particularly relevant for African financial institutions as Nigerian regulators intensify supervision of AML/CFT controls.

Technology Alone Does Not Guarantee Compliance…..

Across Africa, banks, fintechs and payment service providers have invested heavily in automated transaction monitoring solutions. Yet compliance failures often arise not because institutions lack technology, but because alerts are poorly calibrated, investigations are delayed, or governance over monitoring systems is weak.

In Nigeria, for example, financial institutions are required to file Suspicious Transaction Reports (STRs) with the Nigerian Financial Intelligence Unit (NFIU) under the country’s AML/CFT framework. Similar obligations exist across jurisdictions such as Kenya, Ghana, South Africa and Rwanda.

The challenge is ensuring that monitoring systems accurately identify suspicious behaviour without overwhelming investigators with false positives or, more critically, suppressing genuine risks through overly restrictive thresholds.

An alert ignored is often a regulatory risk waiting to materialise.

African Institutions Face Similar Risks….

Several African regulators have increased enforcement against institutions with weak AML controls.

The Central Bank of Nigeria (CBN) has, over the years, sanctioned banks for deficiencies in Know Your Customer (KYC) compliance, customer due diligence, sanctions screening and AML control frameworks. Likewise, the Financial Sector Conduct Authority (FSCA) and the Prudential Authority in South Africa have continued to strengthen supervisory expectations around financial crime controls, while the Financial Intelligence Centre (FIC) has issued administrative sanctions against accountable institutions for failures in customer due diligence, risk management and reporting obligations.

Although these enforcement actions vary in scope, they point to a common regulatory expectation: firms must demonstrate that their AML programmes are effective, risk-based and subject to continuous oversight.

A Familiar Scenario….

Imagine a Nigerian commercial bank implementing a sophisticated transaction monitoring solution capable of processing millions of transactions daily.

To reduce investigation volumes, the institution raises the monetary threshold for generating alerts on mobile transfers. Operational efficiency improves, and compliance teams celebrate fewer cases to review.

Six months later, investigators discover that fraud syndicates have been structuring transactions just below the threshold, using multiple digital wallets and mule accounts. Hundreds of suspicious transactions were processed without escalation because the monitoring rules were never revalidated against emerging typologies.

This hypothetical scenario closely mirrors the governance issues highlighted in the Merrill Lynch case.

The problem is not the software. The problem is the failure to validate assumptions, test thresholds and challenge whether monitoring rules remain fit for purpose.

Fintechs Are Not Exempt…

Africa’s fintech sector is expanding rapidly, driven by digital payments, mobile money and cross-border financial services.

As customer volumes increase, many fintechs rely heavily on automated compliance platforms and third-party AML solutions. While outsourcing technology can improve efficiency, regulatory accountability remains with the licensed institution.

Whether operating in Lagos, Nairobi, Accra or Johannesburg, compliance officers cannot assume that vendor-configured monitoring rules adequately reflect their institution’s unique risk profile.

Risk appetite, customer behaviour, transaction patterns and emerging typologies differ significantly across markets. Transaction monitoring models must therefore be independently validated and periodically recalibrated.

Questions Every Compliance Officer Should Be Asking

The Merrill Lynch enforcement action presents an opportunity for compliance teams across Africa to critically evaluate the effectiveness of their own AML programmes. The central question is no longer whether an institution has a transaction monitoring system in place, but whether that system is capable of identifying, escalating and supporting the reporting of genuinely suspicious activity.

Compliance officers should begin by asking when their transaction monitoring system was last independently validated. Regular validation is essential to ensure that monitoring models, scenarios and alert thresholds remain aligned with the institution’s evolving risk profile and emerging financial crime typologies.

Equally important is determining whether alert thresholds are supported by documented risk assessments rather than operational convenience. Institutions should also periodically review suppressed or closed alerts to establish whether suspicious transactions are being overlooked because of outdated assumptions, poor calibration or system limitations.

Another critical consideration is whether compliance investigators have sufficient resources to review alerts promptly and within regulatory timelines. Even the most sophisticated monitoring technology offers little value if alert backlogs prevent timely investigations or the filing of Suspicious Transaction Reports (STRs).

Senior management and the board should also receive meaningful management information on the performance of the institution’s AML programme. Metrics such as alert volumes, false-positive rates, investigation backlogs, turnaround times and STR filing trends provide valuable insight into whether transaction monitoring controls are operating effectively.

Ultimately, every institution should be able to demonstrate to regulators that its AML framework is delivering measurable outcomes rather than simply satisfying documentation requirements. Increasingly, supervisory authorities are assessing not just the existence of policies, procedures and technology, but also whether they are effective in detecting, investigating and reporting suspicious activity. These are no longer questions of best practice—they are becoming core expectations of a mature, risk-based compliance programme.

These are no longer best-practice questions. Increasingly, they are supervisory expectations.

Compliance Is Becoming a Governance Issue

Modern AML compliance extends well beyond filing Suspicious Transaction Reports.

Regulators are placing greater emphasis on model governance, data quality, board oversight, independent validation, audit assurance and continuous improvement.

Boards are expected to understand how transaction monitoring systems operate, what assumptions underpin risk scoring models and whether key performance indicators accurately reflect emerging financial crime risks.

For African institutions preparing for mutual evaluations under the Financial Action Task Force (FATF) standards and regional bodies such as GIABA and ESAAMLG, demonstrating the effectiveness of AML controls is becoming just as important as demonstrating their existence.

The Bottom Line

The SEC’s action against Merrill Lynch should not be viewed simply as another U.S. enforcement case. It is a global compliance lesson.

As financial crime becomes increasingly sophisticated, regulators expect institutions to move beyond “tick-box” compliance towards intelligence-led, risk-based AML programmes supported by effective governance and continuous monitoring.

For banks, fintechs and other regulated institutions across Nigeria and Africa, the message is clear: transaction monitoring systems should not merely generate alerts—they must generate confidence. In today’s regulatory environment, the greatest compliance risk may not be the suspicious transaction that is detected, but the one that an institution’s own controls never allow