Bank of America Hit With $1.2 Billion FinCEN Penalty: AML Failures and Compliance Lessons

On October 13, 2026, the U.S. Treasury announced coordinated enforcement actions against Bank of America, N.A.:

• FinCEN assessed a $1.2 billion civil money penalty for anti-money laundering (AML) failures. According to FinCEN, the bank missed or delayed reporting more than $5 billion in suspicious activity.
• The Office of the Comptroller of the Currency (OCC) assessed a $750 million penalty.
• The Office of Foreign Assets Control (OFAC) settled apparent sanctions violations for $11,662,930.

The figures cannot simply be added together. The OCC assessment is credited toward the FinCEN penalty, which is why Treasury describes the actions as totalling more than $1.21 billion, not almost $2 billion.

FinCEN's consent order (No. 2026-03) is unusually detailed about how the bank's transaction monitoring system worked, and why so much activity never reached an investigator in time. That detail is what makes the case useful for compliance teams well outside large banks.

What happened on October 13, 2026?

Three Treasury components acted on the same day:

• FinCEN found that the bank willfully violated the Bank Secrecy Act (BSA) between at least January 1, 2018 and July 1, 2025. Its three findings were that the bank:
  • failed to maintain an adequate AML program
  • failed to conduct required due diligence on correspondent accounts for foreign financial institutions
  • failed to file accurate and timely suspicious activity reports (SARs)
  Bank of America admitted the order's Statement of Facts and Violations. Its admission of willfulness is in the civil enforcement sense the order defines: reckless disregard or willful blindness. That does not require knowledge that the conduct broke the law, or an improper motive.
• The OCC, the bank's prudential supervisor, assessed a $750 million penalty for what FinCEN's announcement calls a "deficient and ineffective" BSA/AML compliance program.
• OFAC announced an $11,662,930 settlement of 475 apparent violations of multiple sanctions programs.

Treasury Secretary Scott Bessent said in Treasury's announcement, that the actions "send a clear message that even the biggest financial institutions are not above the law." Responding to the actions, a Bank of America spokesperson told news outlets, including NBC News and Banking Dive, that "financial crime compliance is serious, and we are responsible for getting it right."

Coordinated penalties after credit

These are the amounts assessed and agreed. Bank of America said it would record a $1.2 billion charge in its third-quarter results. The $5 billion figure is the value of suspicious transactions FinCEN says went unreported or were reported late. It is not a penalty amount.

Why FinCEN penalized the bank

FinCEN's case rests on three Bank Secrecy Act requirements that apply to banks:

• The AML program rule: 31 CFR 1020.210
• Due diligence for foreign correspondent accounts: 31 CFR 1010.610
• Bank SAR filing: 31 CFR 1020.320

FinCEN says more than $5 billion in suspicious activity was missed or reported late. About $1 billion of it involved what FinCEN calls priority national security and illicit finance risks:

• indicators associated with Chinese money laundering networks
• fraud
• potential trade-based money laundering with a substantial southwest border nexus

These are FinCEN's characterizations of transaction patterns. They are not findings that each transaction was proven to be criminal proceeds.

How the monitoring system kept activity away from investigators

The order describes Event Processor (EP), a proprietary system the bank designed in 2010 to manage monitoring alerts. Its design explains most of what followed.

Points, not alerts, created cases. Each rule hit carried a risk weight of 0 to 20 points. EP grouped alerts, generally by customer, into Event Groups and added up their scores. An Event Group became a case for an investigator only when it reached 20 points. FinCEN notes that this threshold was "initially set by stakeholder judgment."

Old alerts expired. Alerts had to accumulate within 13 months of the oldest active alert. Older alerts "retired" and stopped counting. A customer could therefore set off a steady series of moderate alerts for years without ever reaching 20 points at one time.

Scores were sometimes wiped. EP automatically rescored some risk factors to zero using suppression lists that FinCEN describes as built in an "ad-hoc and subjective fashion". About 150,000 active Event Groups triggered this rescoring before it was discontinued in December 2023. It was applied to customers exempt from currency transaction reporting, even though that exemption does not reduce SAR obligations. For one auto-auction customer, more than 20 structuring-related Event Groups were rescored to zero, and only three reached the case threshold.

Outside events drove investigations. Some external events, such as subpoenas, created cases automatically. In some years these "promotion" events drove more than a third of investigations, and close to half in 2023. The bank was often learning about risk from law enforcement rather than from its own monitoring.

Some products were barely monitored. Negotiable instrument deposits, including money orders, were largely outside EP's coverage. As of 2025, no coverage assessment existed for those products. Credit card monitoring was also insufficient, and a trade-based money laundering feature was not used to generate alerts.

The 20-point threshold and the 13-month window were design choices inside one bank's system. They are not regulatory standards. The lesson is about how such parameters are justified and tested, not about the numbers.

The 2023 changes and the missed SARs

In December 2023, the bank lowered the case threshold to either 10 or 12 points and cut the time Event Groups stayed open from 13 months to four.

According to the order, a 2024 lookback found that the bank "had failed to identify and file nearly 8,900 SARs, with transaction activity totaling nearly $4 billion." The order later records that the lookback produced over 8,000 SARs, covering about $3.96 billion, all of which were late filings. These are historical reports filed years after the activity, not a measure of proven crime.

The bank estimated that the revised threshold would add 16,000 U.S. investigations a month. It planned for an "incremental 750" personnel for ongoing volumes, and 800 consultants to complete the one-time lookback. These were projections and plans, not confirmed headcounts.

Late detection matters even when the SARs are eventually filed. A report on activity from years earlier is far less useful to investigators than one filed when the pattern first appeared.

Warnings that did not lead to fixes

The order shows the bank had information suggesting the model was missing activity:

• A 2022 validation said the appropriateness of the 20-point threshold "needs to be justified". It also called some risk-factor weights "counterintuitive", and flagged rescored factors with high SAR yields, including one at 58%.
• The bank's own testing of the threshold asked whether SAR yields differed statistically. It did not ask how much suspicious activity was being missed.
• A 2023 repeat test supported keeping the threshold.
• A 2025 third-party review found underweighted risk factors and a false-negative rate more than twice the bank's own tolerance.

There are three separate controls here:

1. having a model
2. testing whether it catches the risks it is meant to catch
3. acting on what the testing finds

The bank had the first. FinCEN's findings concern the second and third.

Customer due diligence and correspondent banking

The SAR failures were concentrated in a few customer relationships, which the order anonymizes.

• Online auto auction customers. Customers A and B ran platforms connecting U.S. sellers of salvaged vehicles with domestic and foreign buyers. They relied heavily on third-party payments, including money orders from unknown purchasers. Between October 2020 and May 2025, FinCEN identified more than 680,000 transactions forming about 220,000 groups of suspicious deposits, totalling over $660 million. Many involved sequential money orders totalling just under $3,000, and about one in three groups had southwest border purchase locations.
• A closure recommendation that was overruled. Compliance recommended closing Customer A's accounts in 2022. The line of business opposed closure, and a March 2023 mitigation plan replaced the recommendation. Customer A kept accepting third-party payments until June 2025.
• Activity far beyond the expected profile. Customer C processed over $700 million in wires involving high-risk jurisdictions, against an expected profile of $1 million to $4 million in annual sales. Across these customers, nearly $1 billion in high-risk-jurisdiction wires were mostly reported late.
• Correspondent accounts. The bank's policy permitted "simplified" due diligence for correspondent accounts held for foreign branches and affiliates. FinCEN found this deficient. The policy remained in place until December 2024.

What the OCC and OFAC found

The OCC. According to Treasury's announcement, the OCC's $750 million penalty addresses a program that:

• failed to adequately monitor "trillions of dollars" in transactions
• failed to escalate potentially suspicious activity to investigators, including more than a year after the OCC's December 2024 cease-and-desist order
• gave insufficient training to its AML officer and key BSA staff
• had an internal audit function that missed longstanding concerns

The December 2024 order cited weak internal controls, governance and independent testing. It required a third-party assessment of the program and other remediation, without a monetary penalty. The bank neither admitted nor denied those findings. The OCC's findings are a supervisory assessment of the bank's program, separate from FinCEN's investigation.

OFAC. The settlement covers 475 apparent violations totalling $14,834,082, between September 18, 2021 and April 24, 2025, across sanctions programs involving:

• Russia
• Belarus
• Iran
• Burma
• Somalia
• narcotics
• global terrorism

Not every transaction involved every program. OFAC found the violations non-egregious. Of the 475, 62 were voluntarily self-disclosed. The causes OFAC identified include:

• Blocked banks: 403 transactions, totalling $14,340,100, processed through 35 blocked banks. The causes included processing before the screening filter updated, analysts approving matches as false positives, and an alert suppression rule that released flagged payments.
• Alert prioritization: a design flaw ranked exact name and date-of-birth matches as low or medium priority, allowing 31 transactions by three designated individuals.
• Watchlist updates: a 2023 vendor error left the watchlist out of date, and a February 2025 system failure let payments through for a designated company.

OFAC's aggravating factors were:

• reckless conduct
• harm to sanctions program objectives
• the bank's size and sophistication
• earlier cautionary letters about similar conduct

A tolling agreement was the only mitigating factor considered, and it produced no net reduction: the settlement equals the base penalty. OFAC also stated that "each organization remains responsible for its own compliance regardless of whether it relies upon third-party providers."

An OFAC settlement of apparent violations is a civil resolution, not a criminal conviction. Sanctions screening is also a different control from suspicious activity monitoring: OFAC's findings concern screening, and FinCEN's concern monitoring and reporting.

What Bank of America must do next

Beyond the penalty, the bank agreed to comply with the Undertakings in the FinCEN consent order. According to Treasury's announcement, the resolution requires the bank to:

• Conduct a SAR lookback with a third party. The purpose is to find and report suspicious transactions the bank previously failed to detect.
• Commission independent reviews of four areas:
  • its suspicious activity monitoring
  • customer due diligence
  • foreign correspondent account due diligence
  • AML data governance

These reviews focus on priority illicit-finance risks, including activity connected to the southwest border, cartels and narcotics trafficking, Iran and Russia.

The consent order sets out the detailed scope, the consultant arrangements and the reporting timetable for these Undertakings. Specific deadlines are set out in the order, and are not summarized here. Bank of America says it has invested billions of dollars and thousands of employees in financial crime controls, and that it is "far along" in the work its regulators had already required.

These are obligations specific to Bank of America under its orders. They are not deadlines or requirements for any other institution.

What U.S. MSBs and fintechs can learn

Bank of America was penalized under bank rules. Money services businesses (MSBs) have their own BSA framework:

• AML program: 31 CFR 1022.210. It requires risk-based policies, procedures and internal controls, a compliance officer, training, and an independent review "commensurate with the risk". It does not require automated monitoring, though businesses with automated systems should integrate their compliance procedures into them.
• SAR filing, compared:
  • Banks (31 CFR 1020.320) report suspicious transactions of at least $5,000 that meet the rule's conditions, within 30 calendar days of initial detection. They may delay a further 30 days to identify a suspect if none was identified, but no more than 60 days in total.
  • Covered MSBs (31 CFR 1022.320) generally report at $2,000. The threshold is $5,000 where an issuer of money orders or traveler's checks identifies transactions from clearance records. Check cashers are not covered. The deadline is 30 calendar days from initial detection, with no general extension for an unidentified suspect.
  • Both must notify law enforcement immediately by telephone where a violation requires immediate attention, such as an ongoing money laundering scheme.

The foreign correspondent account rules apply to defined covered institutions. An MSB is not automatically subject to a bank-style program because of this case.

The control lessons still transfer:

None of these is a prescribed methodology. They are practical tests drawn from what went wrong in this case. An MSB's independent review under 31 CFR 1022.210(d)(4) is one place to run them, through an internal reviewer or external BSA/AML audit services. That review is not equivalent to the bank-specific reviews in Bank of America's orders, and it does not guarantee compliance. Weaknesses in the program design itself are a matter for BSA/AML compliance program updates.

Self-assessment checklist

• Can you show that every transaction type and channel feeds your monitoring?
• Do you know how many alerts never become cases, and have you reviewed a sample?
• Are your thresholds, weights and look-back periods documented and supported by testing?
• Does testing look for missed activity, not just alert efficiency?
• Is every suppression or exemption approved, justified and periodically reviewed?
• Do audit and validation findings have owners, due dates and evidence of a retest?
• Can compliance escalate a customer exit without being overruled informally?
• Are high-risk customers' actual volumes compared with their expected activity?
• Are SARs filed within your rule's timeframe from initial detection?
• Where you screen against OFAC lists, are list updates and alert priorities tested?

For U.S. MSBs and payment businesses that want to act on lessons like these, especially monitoring gaps, unresolved review findings and weak escalation, ComplyFactor provides compliance remediation support. That support covers root-cause analysis, risk-prioritized corrective-action plans, updates to monitoring and escalation procedures, and evidence organized for follow-up review.