What happened
The Treasury Department announced more than $1.21 billion in penalties against Bank of America for violations of anti-money laundering and sanctions laws. FinCEN assessed a $1.2 billion penalty, the third largest in the department's history, and the Office of the Comptroller of the Currency assessed a $750 million civil money penalty, the largest in its 163 years. Treasury credited the OCC penalty against the FinCEN assessment. OFAC separately announced an $11.6 million settlement covering 475 apparent violations of sanctions programs tied to Iran, Russia, narcotics and global terrorism. No asset cap was imposed.
Bank of America admitted it willfully violated the Bank Secrecy Act. FinCEN said the bank failed to implement and maintain an AML program that met the minimum requirements of the BSA and its implementing regulations, failed to conduct due diligence on correspondent accounts for foreign financial institutions, and failed to file suspicious activity reports covering $5 billion in transactions. More than $1 billion of that activity involved national security related and other priority illicit finance risks, including Chinese money laundering networks and illicit finance along the southwest border.
The OCC said the bank failed to properly monitor trillions of dollars in transactions and "knew for years that it was failing to escalate potentially suspicious activities to investigators for review." FinCEN added that the bank effectively outsourced substantial portions of its suspicious activity detection to law enforcement and other financial institutions.
This was not a first finding. Bank of America agreed to a cease and desist order in December 2024 over BSA/AML deficiencies, and the OCC said the bank did not complete the steps needed to establish an effective program. More than a year later it still was not escalating potentially suspicious activity, and it processed transactions that looked like trade-based money laundering because of a flaw in its transaction monitoring. The FinCEN consent order requires a third party to run a lookback review for suspicious transactions that went undetected. Treasury Secretary Scott Bessent said, "Even the biggest financial institutions are not above the law."
Why this is a GRC story
A repeat finding is what turned a supervisory issue into a nine figure penalty. The 2024 order set out what good looked like. The 2026 penalty reflects the absence of evidence that the bank delivered it, which is why remediation needs to be tracked as completed control changes rather than projects in progress.
Monitoring and reporting are the controls examiners can test. When suspicious activity detection is effectively delegated to law enforcement and other banks, the institution loses the internal record that shows its program works.
One monitoring gap hit two regimes. The sanctions settlement came out of the same population of transactions, so decisions about how transaction monitoring is designed carry both AML and sanctions consequences.
What to watch
Watch how the third party lookback is scoped, whether it surfaces activity that leads to further enforcement or private litigation, and whether other large banks with open BSA related orders get comparable treatment. Watch too for pressure on personal accountability. Reporting on the announcement quotes calls for structural punishments and for executives to be held personally accountable. For compliance teams everywhere, the practical question is whether their own open regulatory findings have documented closure evidence attached to every required action.
Attribution: Analysis based on FinCEN and related public reporting. This article is original commentary, not a repost of the source material.