In brief
- US regulators hit Bank of America with over USD 1.21 billion in penalties on 13 October, including a record USD 750 million OCC fine, after the bank admitted wilful Bank Secrecy Act violations.
- The bank failed to flag over USD 5 billion in suspicious transactions on time, USD 1 billion of it tied to national security risks, leaning on outside tips instead of its own monitoring.
- A separate USD 11.6 million OFAC settlement covered 475 sanctions breaches spanning Russia and Iran, and the bank must now bring in independent reviewers to test its systems.
On 13 October 2026, the US Treasury announced enforcement actions imposing more than USD 1.21 billion in penalties against Bank of America for anti-money laundering and sanctions failures. The action concerned weaknesses in identifying, investigating and reporting suspicious transactions, and illustrated how deficiencies within banking institutions can undermine the financial intelligence available to authorities investigating organised crime and national security threats.
As part of its resolution with the Financial Crimes Enforcement Network (FinCEN), the bank admitted that it had knowingly violated the Bank Secrecy Act by maintaining an inadequate anti-money laundering programme, failing to conduct adequate due diligence on correspondent accounts for foreign financial institutions, and failing to file Suspicious Activity Reports (SARs). FinCEN identified exposure to priority illicit-finance risks, including Chinese money laundering networks and activity connected to the US southwest border.
The US Treasury noted that the bank failed to report more than USD 5 billion in suspicious transactions in a timely manner, including over USD 1 billion implicating national security-related and other priority risks. It also found excessive reliance on law enforcement enquiries and referrals from other financial institutions, rather than the bank’s own monitoring protocols.
The Office of the Comptroller of the Currency (OCC) also identified insufficient staff expertise, inadequate training and weaknesses in internal audit. Significant deficiencies persisted despite a December 2024 order requiring improvements. The OCC imposed a $USD 750 million civil penalty on the bank, the largest in the regulator’s history.
A separate OFAC settlement addressed 475 apparent sanctions violations. The identified weaknesses included payments routed through blocked banks, poorly calibrated sanctions alerts, delays in updating watchlists and errors involving accounts associated with blocked persons. The USD 11.6 million settlement covered apparent violations across several programmes, including those relating to Russia and Iran.
Under the remediation requirements, Bank of America must engage independent specialists to review historical transactions for previously unidentified suspicious activity and test the effectiveness of its monitoring arrangements.
This case highlights the distinction between maintaining a compliance framework and producing timely, useful financial intelligence. For investigators and regulated businesses, the central issue is whether warning signs lead to meaningful enquiries, escalation and action. When concerns remain unresolved or reporting follows only after external intervention, the resulting gaps can impede criminal investigations and prove more than a little costly.