Bank of America Fined: Inside the $1.21bn AML and Sanctions Penalties

Why was Bank of America fined? The short answer

Bank of America was fined because three Treasury agencies concluded that its controls against money laundering and sanctions breaches did not work. According to the FinCEN announcement, the bank failed "to mitigate and report priority national security risks, including Chinese money laundering networks and illicit finance along the southwest border." The OCC found that its Bank Secrecy Act and anti-money laundering (BSA/AML) compliance programme was "deficient and ineffective". OFAC found 475 apparent violations of US sanctions programmes.

The central finding in the FinCEN case is about detection. Treasury said the bank relied so heavily on law enforcement inquiries, requests from other financial institutions and similar outside interventions, rather than its own automated controls, that it "effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations." Treasury added that as the problems arose, Bank of America "prioritized its revenues and minimized the impact on its required compliance resources."

The conduct covered by the FinCEN order took place from at least 1 January 2018 to 1 July 2025, the period the FinCEN consent order calls the Relevant Time Period. The order describes Bank of America as the second-largest US bank, with roughly $2.7 trillion in total assets.

One legal nuance matters for anyone reading the headlines. The admission of willfulness is limited: the consent order records that Bank of America admits "willfulness" only as the term is used in civil enforcement of the Bank Secrecy Act, where the government need only show reckless disregard or willful blindness rather than knowledge that the conduct was unlawful. This is a civil resolution, not a criminal plea.

How the $1.21bn adds up

The headline figures are larger than the total because FinCEN credited the OCC payment against its own penalty. Section V of the consent order imposes a civil money penalty of $1,200,000,000, then states that FinCEN "has agreed to credit against the Civil Money Penalty payment of $750,000,000 to the OCC." Bank of America therefore pays $450 million to Treasury under the FinCEN order, $750 million under the OCC action and $11,662,930 to OFAC, which is how the Treasury reaches "more than $1.21 billion".

Agency	Action	Amount	Core finding
FinCEN	Consent order imposing civil money penalty	$1.2 billion ($750 million credited for the OCC payment, $450 million paid to Treasury)	Willful failure to maintain an AML programme, conduct foreign correspondent due diligence and file SARs; over $5 billion of suspicious activity not reported on time
OCC	Civil money penalty	$750 million	Deficient and ineffective BSA/AML compliance programme, continuing after a December 2024 cease-and-desist order
OFAC	Settlement agreement	$11,662,930	475 apparent violations of Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism sanctions
Total	Announced 13 October 2026	More than $1.21 billion	Described by Treasury as including the third-largest penalty in its history

The bank told the BBC that its third-quarter results would include a non-tax-deductible charge of $1.2 billion, reducing net income by approximately 17 cents per share. According to Banking Dive, no asset cap was imposed, a point that drew criticism in Washington and is discussed below.

What FinCEN found: a monitoring system that waited for others

FinCEN's case turns on Event Processor, the proprietary transaction monitoring system that the bank designed and first implemented in 2010 and that served as its primary control for identifying suspicious activity. Individual alerts were generally not reviewed by an investigator; instead each was given weighted "risk factors" and combined, usually at customer level, into an Event Group. An Event Group generally became a case for human investigation only when its combined score reached 20 points within 13 months of its oldest active alert.

FinCEN found several problems with that approach:

• Thresholds without evidence. The 20-point threshold was "initially set by stakeholder judgment" and stayed in place until December 2023. Many risk factor weights were not anchored in the relevant risks; one factor with a SAR yield of 56.75% in the bank's own testing carried a weight of one point.
• Outside triggers doing the work. Cases could also be created by "auto-promote" events, much of which came from outside the system, such as seizure warrants, subpoenas and law enforcement referrals. For several years, auto-promotion contributed to more than one-third of all the bank's investigations.
• Late reporting. Because activity was aggregated before review, the bank filed a material portion of its SARs more than six months after the relevant activity, and some investigations started more than a year after the transactions.
• Testing that was not acted on. When an internal test produced an unfavourable result, the order says the then Global Head of Financial Crimes directed a senior manager to repeat the test, which achieved a more favourable result.

The consequences became visible when the bank changed course. After engagement with its prudential regulators, Bank of America lowered the 20-point threshold to 10 or 12 points in December 2023 and cut the Event Group window from 13 months to four. A one-time lookback in 2024 under the revised parameters found that the bank had failed to identify and file nearly 8,900 SARs, covering transaction activity of nearly $4 billion. The bank estimated that the new thresholds would double its monthly US investigations and require an incremental 750 personnel, plus 800 consultants for the lookback itself.

Those numbers fed directly into the penalty. FinCEN said the need for roughly 750 extra staff indicated that the bank "had likely saved hundreds of millions of dollars in compliance-related expenditures" during the Relevant Time Period, and it gave greater weight to that financial gain when setting the penalty.

Customer due diligence and the online auto auction customers

The second strand of the case is customer due diligence (CDD), and it shows how a monitoring gap and a weak customer risk profile can compound each other. The consent order says Bank of America's risk profiles for certain higher-risk corporate customers did not reflect their heavy reliance on payments from third parties with whom the bank had no relationship, or their international activities and exposure to jurisdictions with elevated trade-based money laundering and sanctions evasion risk.

The examples FinCEN gives involve customers in the online auto auction industry. Event Processor provided only limited coverage of large volumes of negotiable instrument deposits, despite the bank knowing that some higher-risk customers showed suspicious patterns with that product. The order identifies over $600 million of transactions with indicia of potential trade-based money laundering involving salvaged vehicles, roughly one-third with a nexus to the southwest border. It also records that, despite compliance staff initially recommending that some of these customers be offboarded, the bank "prioritized the revenue associated with these customer relationships."

The cross-border dimension is explicit. FinCEN identified nearly $1 billion in suspicious wires for which the bank failed to file timely and accurate SARs, primarily involving Georgia, Belarus and other Commonwealth of Independent States countries. Most of that activity occurred at the time of or after Russia's invasion of Ukraine in February 2022, and roughly 98% by value was linked to customers in auto-related industries. The first SAR, covering about 10% of the activity, was not filed until August 2023, and the bulk was reported only in June 2025 after FinCEN requested information. For teams working on economic crime risk, the lesson is that the warning signs were inside the bank, escalated by its own people, and still did not change the customer's risk rating or monitoring.

Correspondent accounts for its own foreign branches

The finding most relevant to international groups concerns correspondent accounts that Bank of America maintained for its own foreign branches and affiliates. Until late 2024, the bank had a policy permitting "simplified" due diligence with "reduced requirements" for those accounts, on the footing that the branches mainly served large multinationals, financial institutions and institutional investors.

FinCEN examined twelve foreign branches and affiliates and found due diligence files that lacked information on the expected activity and purpose of the accounts, described the business in general terms such as "treasury services" or "cash management", and gave little more than the name of the local regulator. Critically, the branches and affiliates maintained accounts for more than 250 non-bank financial institutions, including money services businesses or their foreign equivalents, whose payments were inconsistent with the "interbank settlement" profile the bank had assumed.

The point is structural. FinCEN's finding shows that US correspondent due diligence rules bite even when the foreign respondent is part of the same group, so the choice between operating abroad through a branch or a subsidiary, discussed in our guide to branch versus subsidiary structures, does not remove the need to document what each intra-group account is for and who ultimately uses it.

The OCC penalty: two years after a cease-and-desist order

The OCC case is about failure to fix known problems. On 23 December 2024 the OCC issued a cease-and-desist order against Bank of America for deficiencies in its BSA and sanctions compliance programmes, including a failure to file suspicious activity reports on time. The OCC's 13 October 2026 release says that, after agreeing to that order, the bank "still failed to prioritize BSA/AML compliance", did not complete many of the significant steps required, and more than a year later was still failing to escalate potentially suspicious activity to investigators.

The OCC also found that the bank's transaction monitoring system resulted in a failure to properly monitor trillions of dollars in transactions, that its BSA Officer and staff "lacked sufficient skills and expertise", that key BSA personnel lacked appropriate training, and that the BSA audit function failed to identify long-standing concerns that examiners later uncovered.

Comptroller Jonathan V. Gould was blunt: "The bank's poor response to its BSA deficiencies is unacceptable. The second largest bank's egregious and continued BSA violations warrant the OCC imposing its largest CMP ever assessed against a bank."

The OFAC settlement: 475 apparent sanctions violations

The sanctions case is the smallest in money but the most instructive on mechanics. The OFAC enforcement release says that between 18 September 2021 and 24 April 2025 Bank of America engaged in 475 apparent violations with a total value of approximately $14,834,082, arising from four issues:

• Payments through blocked banks. An automated routing process introduced in May 2021 relied on a third-party "routing directory" that, after Russia's February 2022 invasion of Ukraine, still included banks blocked under the Russian Harmful Foreign Activities Sanctions Regulations. Payments went through because filters had not been updated, analysts cleared alerts as false positives, or an "alert suppression rule" released them. In all, 403 transactions totalling $14,340,100 went via 35 blocked banks between February 2022 and March 2025.
• Exact matches treated as low priority. A design flaw classified alerts for customers whose name and date of birth exactly matched a blocked person as low or medium priority, allowing three designated individuals to make 31 transactions totalling $56,258.
• Watchlist updates that did not arrive. A vendor's human error meant the watchlist was not updated between 24 May and 28 June 2023, and technical problems on 7 February 2025 delayed another update, during which the bank processed 26 transactions for a ship management company designated under the Global Terrorism Sanctions Regulations.
• Human error on blocked accounts. An analyst dismissed an alert on a newly designated beneficial owner, and branch staff moved $189,869 from restricted accounts into a new unrestricted account.

OFAC treated the case as non-egregious, but applied no reduction to the base penalty at all. It found the bank acted recklessly, that its conduct harmed the objectives of several sanctions programmes, that it is a very large and commercially sophisticated institution, and that OFAC had previously issued it multiple cautionary letters about substantially similar conduct. It also criticised "piecemeal or incomplete disclosures" and found that only 62 of the 475 apparent violations were voluntarily self-disclosed. Treasury's whistleblower programme treats OFAC sanctions breaches as violations of the International Emergency Economic Powers Act, the statute at the centre of the separate IEEPA tariff refund litigation, and Iran is one of the four priority risks in the FinCEN order, as our explainer on Iran secondary sanctions sets out. Businesses facing a screening failure of their own will usually want specialist OFAC advisers involved before any disclosure is made.

How the penalties were set

FinCEN's statutory maximums are set per day or per violation, and the consent order does not show a line-by-line calculation. The consent order cites a maximum of $71,545 per day for willful AML programme violations, a cap per willful SAR violation of the greater of the amount involved (up to $286,184) or $71,545, and, for correspondent due diligence failures, a penalty of not less than twice the transaction amount and not more than $1,776,364.

FinCEN then weighed the ten factors in its August 2020 enforcement statement. It gave greater weight to the harm to its mission, the financial gain from saved compliance spending and the systemic nature of the violations. It noted that the investigation was proactive rather than the result of voluntary disclosure, and that although the bank made dozens of productions, these "were often the subject of unreasonable delays" and the bank "undertook no proactive investigation" of the historical activity.

The approach echoes other regulators' use of cooperation as the main lever on penalty size. In the UK, the CMA's recent consumer cases, covered in our report on the Wayfair fines, gave a 40% discount for early settlement; OFAC's guidelines similarly reward self-disclosure, remediation and cooperation, none of which reduced the penalty here.

Reactions from Washington and from the bank

Treasury Secretary Scott Bessent said: "When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks. Today's actions send a clear message that even the biggest financial institutions are not above the law."

Bank of America accepted the outcome while stressing remediation. A spokesperson told Banking Dive that "Financial crime compliance is serious, and we are responsible for getting it right," and that "our team is far along with and committed to completing the work required to address the issues raised by our regulators." Chief executive Brian Moynihan said on the third-quarter earnings call: "At the end of the day, I think we have agreed to call this a settlement and move forward." Chief financial officer Alastair Borthwick said the bank had added thousands of people in BSA/AML roles, but declined to say when the 2024 order might be lifted.

Not everyone thought the outcome went far enough. Senator Elizabeth Warren criticised the absence of an asset cap, saying that "Slap-on-the-wrist fines have become the cost of doing business on Wall Street and are no deterrent," and called for executives to be held personally accountable. The consent order settles FinCEN's claims against the bank only for the conduct it describes during the Relevant Time Period, and expressly does not release any claim against current or former directors, officers or employees, a point white-collar crime specialists will note.

What happens next: the undertakings and the timeline

The penalty ends the investigation but starts a multi-year remediation under FinCEN supervision, on top of the OCC's 2024 order. The consent order requires four independent reviews, each by a consultant FinCEN can veto, at the bank's expense.

Date or deadline	Step
1 January 2018 to 1 July 2025	Relevant Time Period covered by the FinCEN order
18 September 2021 to 24 April 2025	Period of the 475 apparent OFAC violations
23 December 2024	OCC cease-and-desist order on BSA and sanctions compliance
13 October 2026	Treasury, FinCEN, OCC and OFAC announce the penalties and publish the consent order
Within 30 days of the order	Bank proposes a consultant to test suspicious activity monitoring, first of interim controls, then of the end state
Within 60 days of the order	Bank proposes consultants for the SAR lookback, the CDD and foreign correspondent due diligence review, and the data governance review
Within 150 days of engagement	SAR lookback consultant delivers its scope report, then quarterly progress reports
No later than December 2028	Final SAR lookback report; any required SARs filed within 90 days after it

The SAR lookback covers activity from January 2022 until the bank completes its remediation, with priority on four "Priority Illicit Finance Risks": the southwest border, cartels and narcotics; Chinese money laundering networks; Iran; and Russia. The order invites the consultant to consider graph analytics and supervised "super intelligence" models. The heading of the monitoring review refers to "Responsible Innovation", and Treasury warned that firms cannot disregard internal warnings about ineffective controls "whether under the guise of innovation or otherwise."

A wider pattern: Amex five days earlier, and Treasury's message

Bank of America fined over AML failures was not an isolated event. Five days earlier, on 8 October 2026, the OCC announced a cease-and-desist order and a $350 million penalty against American Express National Bank, finding systemic breakdowns in suspicious activity monitoring and a failure to identify and report approximately $13 billion of suspected trade-based money laundering over the past decade.

Treasury's own conclusion is that AML and sanctions compliance should not be run in isolation: given the "converging nature" of the risks, institutions "should ensure their AML and sanctions compliance efforts are effectively integrated and mutually reinforcing." It also highlighted its whistleblower programme, under which individuals in the United States or abroad may receive awards where their information leads to penalties exceeding $1 million. Criminal cases continue alongside civil ones, as the recent sentencing of a former Nodus Bank chief executive for fraud and Venezuela sanctions evasion shows.

What it means for banks, payment firms and corporates outside the US

The case matters beyond US banks because so many cross-border payments clear in US dollars. Foreign banks that hold correspondent accounts with US institutions should expect closer questions about their own customers, particularly money services businesses and payment intermediaries, now that FinCEN has criticised a US bank for accepting thin files even from its own affiliates. Corporates sending or receiving payments through corridors like those the consent order highlights, Georgia, Belarus and other Commonwealth of Independent States countries, may find their banks asking more about third-party payments and the purpose of incoming wires.

Two themes carry across jurisdictions. First, regulators are treating reliance on external triggers, such as law enforcement requests, as evidence that a firm's own controls have failed. Second, outsourcing does not move responsibility: OFAC said each organisation "remains responsible for its own compliance regardless of whether it relies upon third-party providers." The same expectation now runs through the EU's crypto regime, set out in our note on MiCA licence requirements, and civil claimants have tested commercial links to terrorist groups in court, as the US Anti-Terrorism Act ruling in the MTN litigation illustrates. Groups needing local counsel can search the Corporate INTL directory of US advisers, which, like the wider directory, lists lawyers and advisers in more than 150 jurisdictions.

What in-house teams should do now

The 13 October documents amount to a regulator's checklist that in-house legal, compliance and finance teams can use to test their own programmes:

• Measure what your monitoring actually finds. Track what share of investigations start from your own alerts rather than subpoenas or requests from law enforcement and other banks; FinCEN treated a high external share as a core failure.
• Evidence your thresholds. Document the empirical basis for scoring weights, thresholds and time windows; "stakeholder judgment" alone did not survive scrutiny.
• Respond to test results, and never re-run a test to get a better answer.
• Treat escalations as risk rating events. If compliance recommends offboarding and the business keeps the customer, document a matching change in monitoring.
• Review intra-group correspondent files. Record the purpose, expected activity and underlying customer types for every affiliate and branch account, including non-bank financial institutions.
• Audit your sanctions vendors and suppression rules. Confirm watchlist updates arrive the same day, that exact name and date of birth matches are high priority, and that suppression logic is approved, tested and reviewed.
• Decide early on disclosure. OFAC gave no mitigation for remediation or cooperation here. Prompt, complete self-disclosure and a fulsome response to information requests remain the main levers on penalty size.

OFAC's Framework for OFAC Compliance Commitments remains the baseline, built on five components: management commitment, risk assessment, internal controls, testing and auditing, and training. Where a review uncovers historic failures, an internal investigations team can scope a lookback before regulators ask for one, and specialist banking and finance advisers in the US can advise on correspondent relationships, consent orders and engagement with FinCEN and the OCC. If you would like an introduction, use the Find an Expert form below this article to submit a request and be put in touch with a member.

Frequently asked questions

Why was Bank of America fined?

US Treasury agencies fined Bank of America more than $1.21 billion on 13 October 2026 for anti-money laundering and sanctions failures. FinCEN found it willfully failed to maintain an adequate AML programme, conduct foreign correspondent due diligence and file suspicious activity reports, leaving over $5 billion of suspicious transactions unreported on time.

Was Bank of America fined for money laundering?

Bank of America was not charged with laundering money itself. It was penalised for failing to detect and report potential money laundering by customers, including activity linked to Chinese money laundering networks, trade-based laundering and the southwest border. The resolution is civil, and the bank admitted willfulness only in the civil enforcement sense.

How much did Bank of America pay?

FinCEN imposed $1.2 billion but credited the $750 million OCC penalty, so $450 million goes to Treasury under the FinCEN order. With the $750 million OCC penalty and the $11,662,930 OFAC settlement, the total is more than $1.21 billion. The bank said the charge is not tax-deductible.

What did OFAC find against Bank of America?

OFAC found 475 apparent violations between September 2021 and April 2025, worth about $14.8 million. Most involved payments routed through 35 blocked banks, largely under Russia sanctions. Others came from poorly prioritised alerts, delayed watchlist updates and human error on blocked accounts. OFAC applied no reduction to the base penalty.

What is a suspicious activity report?

A suspicious activity report (SAR) is a filing a US bank must make to FinCEN when it detects transactions that may involve money laundering or other illicit activity. Banks generally must file within 30 calendar days of initial detection. FinCEN found Bank of America filed many SARs late or not at all.

Why is the OCC penalty the largest in its history?

The OCC said Bank of America's BSA/AML programme remained deficient almost two years after it agreed to a December 2024 cease-and-desist order. Comptroller Jonathan Gould called the violations "egregious and continued", which he said warranted the largest civil money penalty the OCC has assessed against a bank.

Which other banks have been fined for money laundering recently?

Five days before the Bank of America penalties, on 8 October 2026, the OCC imposed a cease-and-desist order and a $350 million penalty on American Express National Bank for failing to identify and report about $13 billion of suspected trade-based money laundering over a decade.

What does Bank of America have to do next?

The FinCEN consent order requires independent consultants for a SAR lookback, effectiveness testing of suspicious activity monitoring, a review of customer and foreign correspondent due diligence, and a data governance review. The final SAR lookback report is due no later than December 2028, with any required SARs filed within 90 days.

Does the case affect non-US companies?

Yes, indirectly. Foreign banks with US correspondent accounts, payment firms and corporates sending dollar wires through higher-risk corridors can expect more detailed questions from their US banks about customers, third-party payments and the purpose of transactions, as US banks respond to FinCEN's focus on correspondent due diligence.

Sources

1. U.S. Department of the Treasury: U.S. Treasury Announces Record Enforcement Actions Against Bank of America (13 October 2026)
2. FinCEN: FinCEN Assesses $1.2 Billion Penalty against Bank of America (13 October 2026)
3. FinCEN: Consent Order Imposing Civil Money Penalty, In the Matter of Bank of America, N.A. (October 2026)
4. Office of the Comptroller of the Currency: OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance (13 October 2026)
5. OFAC: Enforcement Release, Bank of America, N.A. Settles with OFAC for $11,662,930 (13 October 2026)
6. Office of the Comptroller of the Currency: OCC Issues Cease and Desist Order Against Bank of America for BSA Deficiencies (23 December 2024)
7. Office of the Comptroller of the Currency: OCC Assesses $350 Million Civil Money Penalty Against American Express (8 October 2026)
8. OFAC: A Framework for OFAC Compliance Commitments (May 2019)
9. Banking Dive: BofA fined $1.21B over AML flaws (13 October 2026, updated 14 October 2026)
10. BBC News: Bank of America hit with $1.2bn fine for money laundering failings (14 October 2026)

About this article

This analysis was researched and written by The Corporate INTL Newsroom, which covers cross-border legal, regulatory and business developments for lawyers, professional advisers and financiers in over 150 jurisdictions. It has been checked against the US Treasury, FinCEN, OCC and OFAC announcements of 13 October 2026, the FinCEN consent order, the OFAC enforcement release, the OCC's December 2024 cease-and-desist announcement and its 8 October 2026 American Express release, and reporting by Banking Dive and the BBC of the bank's response. The OCC's own consent order for its $750 million penalty was not reviewed in full. This article is general information, not legal advice; for advice on a specific matter, consult a qualified adviser. Last reviewed 19 October 2026. For more analysis like this, visit the Corporate INTL newsroom or subscribe to Corporate INTL.