US Treasury agencies have imposed more than US$1.21 billion in penalties on Bank of America, N.A. for anti-money laundering (AML) and sanctions failures. According to the Treasury's announcement on 13 October 2026, the package is the third-largest penalty the Treasury has ever levied.
There are three separate actions. The Financial Crimes Enforcement Network (FinCEN) assessed a US$1.2 billion civil money penalty under the Bank Secrecy Act (BSA). The OCC assessed a US$750 million civil money penalty for a deficient BSA/AML compliance programme, which FinCEN credits against its own penalty. The Office of Foreign Assets Control (OFAC) settled 475 apparent sanctions violations for US$11,662,930. In practice, the bank pays US$750 million under the OCC action, an additional US$450 million under the FinCEN order, and about US$11.7 million to OFAC.
What FinCEN found
In its consent order (Number 2026-03), FinCEN says the bank willfully failed to maintain an adequate AML programme, conduct due diligence on correspondent accounts for foreign financial institutions, and file suspicious activity reports (SARs) on time. Bank of America admits the statement of facts and admits willfulness in the civil sense the BSA uses, which covers reckless disregard or willful blindness. The conduct ran from 1 January 2018 to 1 July 2025.
According to FinCEN, the result was that more than US$5 billion of suspicious activity was either missed or reported late. Roughly US$1 billion of that involved what FinCEN calls national security and other priority risks, including activity pointing to Chinese money laundering networks, fraud, and possible trade-based money laundering closely tied to the US southwest border.
A monitoring system built in-house
Much of the order is about Event Processor (EP), a transaction monitoring system the bank designed itself and first rolled out in 2010 as a proof of concept. Internal bank records billed it as an industry first. FinCEN says EP aggregated activity, often over long periods, before any human investigator reviewed it, so investigators sometimes couldn't meaningfully review the activity and SARs reached FinCEN late or with limited detail.
The figures in the order show the scale. After the bank changed EP's thresholds following engagement with regulators, a one-time lookback in 2024 found that, under the revised settings, nearly 8,900 SARs, covering close to US$4 billion of activity, should have been identified and filed but were not. The bank estimated that the new thresholds would add about 16,000 US investigations a month, double its previous monthly volume, and require 750 additional staff on top of around 800 consultants to finish the lookback.
FinCEN also found that between 2018 and 2023, 76% of EP's risk factor weights never changed, and that about 80% of the changes reduced a weight rather than raised it. Treasury's reading is blunt: revenue came first, the burden on compliance was kept down, and nothing meaningful changed even after testing exposed serious weaknesses.
The OCC and OFAC actions
The OCC's penalty rests on violations of 12 CFR 21.21 and 12 CFR 21.11. The bank was already under a December 2024 cease-and-desist order requiring it to fix its BSA/AML programme. A year after issuing that order, the OCC says the bank still was not passing potentially suspicious activity to investigators for review. Comptroller of the Currency Jonathan V. Gould called the bank's response to its BSA deficiencies unacceptable.
The OFAC settlement covers 475 apparent violations between 18 September 2021 and 24 April 2025 across sanctions programmes on Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism. Of the four root causes OFAC identifies, two came down to screening: the bank was slow to add newly designated names to its watchlists, and it gave too little weight to alerts where a customer's name and date of birth were an exact match for a blocked person. The other two were payments that ran through correspondent links to blocked banks, and human mistakes in the handling of two business accounts connected to blocked persons. OFAC judged the apparent violations non-egregious and largely not voluntarily self-disclosed, and gave no reduction to the base penalty for remediation or cooperation.
What the bank must do now
Under the FinCEN order, Bank of America must work with a third party to conduct a lookback to identify and report suspicious transactions that went undetected. An independent reviewer will also examine how the bank monitors suspicious activity, carries out due diligence on customers and foreign correspondents, and governs the data behind its AML programme. Treasury wants the review to show whether the programme can cope with three priority threats: the US southwest border, cartels and narcotics trafficking; Iran; and Russia. Under the OFAC settlement, Treasury says, the bank has also committed to compliance steps on training, testing and audit, along with ongoing communication and cooperation with OFAC.
Why this case matters
This case is less about a missing policy than about a monitoring model that drifted from the bank's risk profile and went unaddressed. Treasury's compliance message is direct: firms cannot brush aside internal warnings that controls aren't working; innovation is no excuse, and firms cannot treat subpoenas or referrals from other banks as a substitute for their own detection.
It also follows a run of large US BSA actions, from FinCEN's US$125 million penalty against UBS to the agencies' proposal for an AML effectiveness test for banks. Treasury also pointed to the link between AML and sanctions risk, urging firms to integrate the two programmes, a theme that echoes FATF's warning on underground banking and professional money launderers.
Read the full FinCEN consent order and OFAC enforcement release.
