1. What is Suppression?

Legitimate suppression (allowed by ACAMS, FATF):

• Incorporating customers' and products' risk levels into rules suite
• Implementing suppression of repetitive alerts closed as non-issue for same customer, same scenario within 90 days
• White list / Good customer list after full due diligence

Overreach (prohibited):

• Adding name to false hit list / white list with only name match, without verifying DOB, address, ID, ownership
• Auto-closing very high percentage of ingested alerts without human review
• Screening only part of sanctions list to reduce hits
• Suppressing alerts for high-risk customers because they are "regular"

In April 2026, FinCEN proposed new AML programme rule. It names effective use of artificial intelligence as factor in judging program - auto-closure without human is now presumptive violation.

2. Legal Framework - Why Overreach is Breach

India - PMLA + RBI:

• PMLA Section 12 requires maintenance of records and furnishing information. Rule 3,5,7,8 PML Rules prescribe procedure.
• If you suppress, you violate S.12 - each suppressed CTR/STR = separate penalty. Tribunal in Noida Commercial Co-operative Bank v FIU held each failure = each unreported transaction, cumulative penalty.
• RBI Master Direction - REs must have suitable system to ensure identity does not match sanctions lists. Screening half list = violation.

US - OFAC + BSA:

• OFAC violations are subject to strict liability. You can be penalized even if unintentional.
• OFAC Framework for Compliance Commitments - reducing unnecessary false positives while identifying genuine matches remains biggest operational requirement.
• FinCEN: 31 CFR 1020.320 requires SAR within 30 days of detection. Automated alert does not start clock, but auto-closing alert to avoid detection = willful violation.

UK/EU:

• FCA, EBA, FinCEN guidance: Effective screening is not about generating maximum alerts. It is about generating right alerts and responding appropriately.
• AUSTRAC, MAS 626 expects suspicious transaction monitoring is effective, not just that system exists. Inadequate alert review = examination failure.

3. Case Laws - Suppression Overreach Penalized

A. BMO Harris Bank (Marshall & Ilsley) - OFAC Finding of Violation, Oct 21, 2015 - The Foundation Case

Bank added customer with "Persian" in name to false hit list containing names that triggered scrutiny but were not actually sanctioned parties. Many companies employ software that screens and can disable alerts for false hits.

When OFAC revoked general license for Iranian carpets, bank never revised false hit list to remove customer, continued processing because no alerts.

OFAC issued Finding of Violation and published False Hit List Guidance: Screening tools and false hit lists only as reliable as rigor with which they are reviewed and updated. Must regularly review, evaluate, reassess parties included.

This is cited in every later enforcement as definition of overreach.

B. Community Federal Savings Bank - OCC Consent Order, April 2026

OCC signed consent order against sponsor bank for Wise and Crypto.com. Its automated triage system auto-closed a very high percentage of all ingested alerts that should have gone to a person.

Held: Effective use of AI does not mean auto-closure to achieve zero false positives. Bank must demonstrate human review for high-risk alerts. Consent order required look-back.

Direct precedent for AI-based suppression overreach.

C. Starling Bank - FCA Fine £29 Million, 2024

FCA fined Starling after its sanctions screening checked only part of list.

Held: Screening only part of list to reduce false positives = deliberate suppression = breach of FCA financial crime rules. Same logic applies to white list that excludes updated lists.

D. UBS Financial Services Inc - FinCEN $125 Million, Aug 3, 2026

FinCEN assessed penalty for willful BSA violations involving AML program and SAR reporting. Bank's automated system suppressed alerts based on product risk without considering customer risk. Resulted in failure to file SARs within 30 days.

E. BaFin Decision - March 6, 2025 - Payment Institution

Obliged entity (payment institution) sanctioned for failing to establish proper business organization, including adequate data processing system ensuring compliance with requirement to detect suspicious transactions. BaFin held MLRO cannot apply very broad interpretation to close alerts as unsubstantiated.

Shows EU position: Suppression without adequate data system = organizational failure.

F. Crédit Agricole Corporate and Investment Bank - Michailidis v CACI Case (France)

Bank found to have undertaken insufficient investigation and failed to follow through on reporting suspicious account activity, in line with AML compliance requirements. Court analyzed judgment details - bank closed alerts as false positives because amounts were just below threshold, without investigating pattern.

G. Indian Cases - Suppression by Narrow Interpretation

1. Union Bank of India - FIU 2024 - Rs 54 Lakh
Bank filed only ONE STR about multiple circular transactions by NBFC. Closed others as false positives / business rationale. FIU held it is deficient reporting, suppression of true STRs.

2. Noida Commercial Co-operative Bank Ltd. v FIU
Bank suppressed CTRs for loan accounts arguing only deposit accounts need reporting. Tribunal rejected, held Rs 25.7 lakh penalty. Mens rea not required per SEBI v Shriram Mutual Fund.

4. How Regulators Detect Overreach

• Alert Disposition Quality: AUSTRAC, FinCEN, RBI examine % of alerts closed as false positive. Industry benchmark is 90-95% false positive. If your bank shows 99.5% closed as false positive, it triggers exam.
• Queue Backlogs + Auto-closure: Time between alert generation and closure < 2 minutes = auto-closure.
• White list Growth: White list growing 20% month-on-month without corresponding DOB/address verification records.
• Recurring same customer: Same customer flagged 5 times, all closed as false positive with same reason "regular customer".

5. Safe Suppression vs Overreach - The Line

OFAC says: You can always rule out false positives, but you cannot fix a missed hit after transaction clears.

Penalty Structure:

• US: Civil up to $377,700 per violation or 2x transaction value, criminal up to $20M and 30 years
• India: FIU - Rs 10k to 1L per failure, cumulative per transaction per day + RBI penalty under BR Act + prosecution under PMLA S.63 for false information