On 13 October 2026, the U.S. Department of the Treasury fined Bank of America $1.21 billion following multiple violations of Anti-Money Laundering (AML) and sanctions laws. Notably, regulators found over $5 billion in unreported suspicious activity and more than 475 apparent sanctions violations.
The fine is the third-largest penalty in Treasury history, after Binance ($3.4 billion in 2023) and TD Bank ($1.3 billion in 2024). It also represents the largest enforcement penalty in the Office of the Comptroller of the Currency (OCC) history.
The Key Regulatory Players
Three critical regulatory players enforced the penalty. These include FinCEN, OCC, and OFAC. All three regulators imposed separate settlements on the bank, totaling $1.21166 billion in fines. Most importantly, Bank of America has had significant AML deficiencies for years. Despite warnings, including one in December 2024, the company failed to deliver sufficient corrective action.
- Financial Crimes Enforcement Network (FinCEN), $1.2 billion
- Office of the Comptroller of the Currency (OCC), $750 million
- Office of Foreign Assets Control (OFAC), $11.66 million
The lesson for financial institutions is clear. Simply acknowledging and implementing a corrective action plan is not enough. However, this challenge can be especially complex for large banks. Notably, Bank of America is the second-largest bank in the United States, serving over 70 million global customers and businesses.
The biggest question remains: What should you do when you identify deficiencies in your compliance program but can’t show you’ve actively remediated them?
Bank of America Prior AML Warning in December 2024
On 23 December 2024, the OCC issued a cease-and-desist order against Bank of America. Supervisory oversight and examinations found that the bank had multiple weaknesses in its AML infrastructure:
- Transaction monitoring was severely deficient, leaving trillions of transactions inadequately monitored. This meant the bank could not effectively identify, review, prevent, or report potentially illicit transactions.
- Suspicious activity was not reported to investigators consistently or in a timely manner. The bank knew about this problem for years yet failed to close the gap. This meant regulators could not pursue potentially damaging money-laundering and terrorist-financing risks.
- Staff training remained persistently weak. The bank did not train employees on critical AML areas, including internal auditing, reporting, and monitoring. This contributed to errors and late suspicious activity reports.
The OCC required the bank to conduct an independent assessment of its AML and sanctions compliance programs. It also explicitly requested robust testing to prove that remediation measures were effective, including independent validation of transaction-monitoring data, models, rules, and thresholds.
From 2025 to 2026, regulators noted that the bank still fell short of rectifying these deficiencies despite remediation, as material gaps remained. In 2026, Bank of America willfully admitted to violations of the Bank Secrecy Act.
The case highlights an important lesson. Compliance failures do not always mean the absence of strong compliance policies. Instead, they can happen when several factors fail to work together effectively. In this case, the domino effect is clear. Monitoring technology, staff expertise, escalation procedures, and independent assurance failed to work together.
How to Demonstrate Compliance Remediation Effectively?
After the OCC’s 2023 cease-and-desist order, regulators shifted from identifying the bank’s deficiencies to actively evaluating whether it made progress against the previously agreed regulatory framework. This emphasizes the direction of AML compliance.
Authorities expect financial institutions to proactively identify, investigate, and prevent financial crime. This is especially crucial today, as AI and newer technologies are driving more complex financial crime typologies. How financial institutions can avoid similar failures:
1. Implement ongoing risk assessment
Businesses should connect Customer Due Diligence (CDD) with ongoing risk assessments. Capture robust customer information, including expected transaction volume and intended purpose of the account. Next, ensure that this information feeds into ongoing risk assessments. Any material changes in customer information or risk must trigger proportionate due diligence measures. Where risks cannot be mitigated effectively, report, reject, or restrict the user account on time.
2. Test screening and monitoring effectiveness regularly
Notably, Bank of America’s screening system flagged high-risk individuals with sanctions matches as low-priority alerts. It is important to test known enforcement scenarios rather than relying solely on routine system testing. For example, businesses can add new sanctioned users to a test environment to confirm the right escalation workflow triggers. Additionally, regularly evaluate Cribado AML data, such as sanctions and watchlist information, to ensure it is accurate and up to date.
3. Document strong and demonstrable remediation
Bank of America says it heavily invests billions of dollars in combating financial crime. However, gaps in its governance are clear. To demonstrate strong remediation, financial institutions must assign accountable owners, set structured deadlines, and independently retest corrective actions. This must be documented clearly, with evidence of resolution retained, including clear timestamps and audit trails.
Encuentre más noticias sobre AML en ComplyCube. Boletín informativo Trust Edition. Analizamos los últimos avances en verificación de identidad y lucha contra el blanqueo de capitales a nivel mundial.
