U.S. regulators announced more than $1.21 billion in coordinated penalties against Bank of America on October 13, citing persistent weaknesses in anti-money-laundering controls and apparent violations of multiple sanctions programs. The Treasury Department described the package as the third-largest penalty in its history, while the Office of the Comptroller of the Currency said its $750 million assessment was the largest it has ever imposed.

How the penalties fit together

The headline amounts are not fully additive. Treasury’s Financial Crimes Enforcement Network assessed a $1.2 billion penalty, but that amount credits the OCC’s $750 million civil money penalty. Separately, the Office of Foreign Assets Control reached an $11.6 million settlement over 475 apparent sanctions violations. OFAC said those matters involved payments connected to programs covering Russia, Belarus, Iran, Myanmar, Somalia, narcotics and global terrorism. It classified the apparent violations as non-egregious and largely not voluntarily self-disclosed.

Related reporting: US Sanctions Network Over Alleged Crypto Funding for Hamas

Regulators identify years of monitoring failures

Treasury said Bank of America admitted willfully violating the Bank Secrecy Act by failing to maintain a compliant anti-money-laundering program, perform required due diligence on foreign correspondent accounts and file suspicious activity reports. According to FinCEN, the bank failed to report more than $5 billion in suspicious transactions on time. More than $1 billion of that activity involved national-security or other priority illicit-finance risks, including suspected Chinese money-laundering networks, fraud and possible trade-based laundering linked to the southwest border.

A 2024 order did not resolve the deficiencies

The OCC said the bank’s transaction-monitoring system failed to properly monitor trillions of dollars in activity and led to large numbers of late reports involving billions of dollars. Its findings also cited gaps in staff expertise, training and audit controls. Bank of America has operated under a December 2024 cease-and-desist order requiring improvements, but the OCC said significant breakdowns continued more than a year later, including failures to escalate potentially suspicious activity for investigation.

Independent reviews and an earnings charge follow

The FinCEN consent order requires Bank of America to appoint a third party to review past transactions, identify suspicious activity missed by earlier controls and submit required reports. Independent reviewers will also assess transaction monitoring, customer due diligence, foreign correspondent-account checks and the data governance supporting the bank’s compliance program. Reuters reported that the bank expects to record a $1.2 billion non-tax-deductible charge in its third-quarter results, reducing quarterly net income by approximately 17 cents a share. The action does not include an asset cap limiting the bank’s growth.

What changes for the bank

Bank of America said it accepts responsibility for financial-crime compliance and has invested billions of dollars in technology and assigned thousands of employees to the work. The enforcement package raises the cost and scrutiny of completing those repairs, while making clear that automated systems, staff expertise and data quality will all be tested. The required reviews specifically prioritize risks involving the southwest border, cartels and possible narcotics trafficking, along with Iran and Russia. For other large banks, the case shows that regulators may treat transaction monitoring, sanctions screening and suspicious-activity reporting as connected controls rather than separate compliance exercises. The penalties establish regulatory findings and required remediation; they do not determine the outcome of every transaction flagged in the government’s review.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.