Bank of America admits wilful BSA breaches as Treasury agencies impose over $1.21bn

The US Treasury announced on 13 October 2026 three enforcement actions against Bank of America over anti-money laundering (AML) and sanctions failures, which it put at "more than $1.21 billion" in penalties:

- The Financial Crimes Enforcement Network (FinCEN) assessed a $1.2bn civil penalty.
- The Office of the Comptroller of the Currency (OCC) assessed a $750m civil money penalty, the largest in its history.
- The Office of Foreign Assets Control (OFAC) settled 475 apparent sanctions violations for $11,662,930.

Treasury called the FinCEN penalty the third-largest in its history. Added together, the three amounts would reach roughly $1.96bn. Atlas reads the lower headline total as meaning that part of one penalty is credited against another.

In its resolution with FinCEN, Bank of America "admits that it willfully violated the BSA". It admits failing to maintain an AML programme meeting the Bank Secrecy Act's minimum requirements, to conduct due diligence on correspondent accounts for foreign financial institutions, and to file suspicious activity reports (SARs). As a result it failed to report on time more than $5bn of suspicious transactions. More than $1bn of that implicated national security and other priority risks, including Chinese money laundering networks, fraud and potential trade-based money laundering "with a substantial nexus to the southwest border".

What the agencies found

Treasury said the bank "prioritized its revenues and minimized the impact on its required compliance resources". It relied so heavily on law enforcement inquiries and requests from other banks, rather than its own automated controls, that it "effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations". Suspicious activity was left uninvestigated for long periods, producing late reports "of limited utility to law enforcement". The bank's customer due diligence did not account for customers' heavy reliance on payments from unknown third parties. It also did not act promptly on red flags, including potential links to narcotics proceeds, even after compliance staff escalated concerns.

The OCC cited violations of 12 CFR 21.21 and 12 CFR 21.11. It found that the bank's transaction monitoring failed to properly monitor "trillions of dollars in transactions". The BSA Officer and staff lacked sufficient skills and expertise, and the audit function missed concerns that examiners later found. More than a year after a December 2024 cease-and-desist order, the bank was still failing to escalate potentially suspicious activity to investigators. A "systemic gap" in monitoring also let potential trade-based laundering through.

OFAC's apparent violations arose in four ways:

- Correspondent payments were routed through blocked banks because of technical and human error.
- Poorly calibrated alerts let designated individuals make payments and withdraw funds.
- Watchlists were not promptly updated after designations.
- Accounts linked to blocked persons were mishandled.

The programmes were Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism. OFAC judged the violations non-egregious and largely not voluntarily self-disclosed. It made no reduction to the base penalty, including none for remedial measures or cooperation.

Remediation and Treasury's warning

FinCEN's consent order requires the bank to work with a third party on a lookback to find and report suspicious transactions that went undetected. The bank must also undergo independent reviews of its suspicious activity monitoring, its customer due diligence and its foreign correspondent account due diligence. A further review covers the data governance behind its AML programme. The reviews will test how the programme addresses the southwest border, cartels and narcotics trafficking, Iran and Russia. Under the OFAC settlement, the bank committed to measures on training, testing and audit, and on future communication and cooperation with OFAC. AML Intelligence reported that the bank is moving 1,000 staff to address the failings.

Treasury also set out compliance considerations for other firms. Financial institutions "cannot disregard mounting red flags or internal warnings about ineffective controls, whether under the guise of innovation or otherwise". Nor can they rely on "law enforcement inquiries, referrals from other financial institutions, or other external sources as substitutes for their own effective internal monitoring and controls". Treasury added: "Merely documenting concerns or engaging in prolonged internal reviews without appropriate corrective action does not satisfy an institution's compliance obligations." It also said AML and sanctions compliance should be "effectively integrated and mutually reinforcing". In Atlas's view, the outsourcing finding is the one other banks should test themselves against.

Treasury also pointed to FinCEN's whistleblower programme. Tipsters in the US or abroad may be eligible for awards when their information leads to an enforcement action with monetary penalties exceeding $1,000,000 and the other requirements of 31 U.S.C. 5323 are met.