USAA fined $140 million over ‘willful’ Bank Secrecy Act lapses