On October 13, the US Treasury announced penalties of more than $1.21 billion against Bank of America, N.A., the second-largest bank in the United States, for failures in its anti-money laundering and sanctions controls. According to Treasury, the bank failed to report more than $5 billion in suspicious transactions to FinCEN on time, and over $1 billion of that activity involved national security and other priority illicit-finance risks.
Three agencies, one bill
The total comes from three separate actions:
- FinCEN: $1.2 billion for failing to mitigate and report priority national security risks. FinCEN named two of them: Chinese money laundering networks and illicit finance along the southwest border. Treasury calls it the third-largest penalty in its history.
- OCC: $750 million civil money penalty for a deficient and ineffective BSA/AML compliance program. It is the largest penalty the OCC has ever imposed.
- OFAC: $11.6 million to settle 475 apparent violations of US sanctions programs.
The OCC penalty is credited against the FinCEN fine, so the two do not add up. That is why the total is just over $1.21 billion and not close to $2 billion.
The bank admitted it
Under the FinCEN resolution, Bank of America admitted that it willfully violated the Bank Secrecy Act. The admissions cover three failures: its AML program did not meet the minimum legal requirements, it did not carry out required due diligence on correspondent accounts for foreign financial institutions, and it did not file suspicious activity reports (SARs) it was required to file.
The 2024 warning
None of this came without notice. In December 2024 the OCC issued a cease-and-desist order requiring the bank to fix its BSA/AML program. According to the OCC, the bank then failed to complete many of the significant steps the order required, and its controls kept breaking down. More than a year after the order, the bank still was not escalating potentially suspicious activity to its investigators.
The OCC's findings go beyond a single broken system:
- Transaction monitoring was deficient, so trillions of dollars in transactions were not properly monitored.
- A systemic gap in that monitoring let potential trade-based money laundering transactions go through.
- The bank knew for years that suspicious activity was not reaching investigators for a SAR decision, and did not fix it.
- It filed large numbers of late SARs involving billions of dollars, many of them showing signs of money laundering.
- The BSA Officer and staff lacked the skills and expertise to run the program, and key BSA staff were not trained to identify, investigate and report suspicious activity.
- The bank's BSA audit function missed long-standing problems that examiners later found.
The OCC also said bank management did not make sure the program was effective and kept downplaying its deficiencies. "The bank's poor response to its BSA deficiencies is unacceptable," Comptroller of the Currency Jonathan V. Gould said.
The sanctions violations
OFAC's settlement covers 475 apparent violations across programs including Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism. Treasury describes four kinds of failure:
- Correspondent banking payments routed through blocked banks, because of technical and human error.
- Sanctions screening alerts that were poorly calibrated, which let designated individuals make payments and withdraw funds.
- Watchlists that were not updated promptly after new OFAC designations.
- Business accounts tied to blocked persons that were mishandled through human error.
OFAC classed the violations as non-egregious but said they were largely not voluntarily disclosed, and the settlement includes no reduction to the base penalty.
The earnings hit
A Bank of America spokesperson told Banking Dive that the bank's third-quarter results include a $1.2 billion charge that is not tax-deductible, reducing net income by roughly 17 cents per share. CFO Alastair Borthwick said the bank believes it is now meeting the consent order's obligations and has added thousands of people to BSA/AML roles. No asset cap was imposed.
What the findings have in common
Read the OCC's list again and most of it is about follow-through, not detection. Alerts were generated and never escalated. Staff looked at activity they had not been trained to judge. Screening rules were set loosely and watchlists ran behind. Internal audit did not catch any of it. The bank was told in December 2024, and by the regulator's account it still had not fixed escalation more than a year later.
For any regulated business, the takeaway is practical. A control only counts if someone can show it works: that alerts reach a person, that the person knows what to do with them, and that the whole chain is checked by someone independent. Regulators are now putting a price on the gap between a control that exists on paper and one that runs every day.
Sources
Hear Team
