Bank of America Hit With $1.21 Billion in Record Penalties Over Unreported Suspicious Activity

Bank of America will pay more than $1.21 billion in civil penalties for failing to report billions of dollars in suspicious transactions, including activity tied to Chinese money laundering networks and illicit finance along the southwest border. The Treasury Department calls it the third-largest penalty in its history and the largest ever assessed by the Office of the Comptroller of the Currency. The bank admitted it willfully violated the Bank Secrecy Act.

Bank of America Hit With $1.21 Billion in Record Penalties Over Unreported Suspicious Activity

Washington, D.C. — The U.S. Treasury Department announced more than $1.21 billion in penalties against Bank of America on 13 October 2026, the third-largest enforcement action in Treasury history and the largest civil money penalty ever assessed by the Office of the Comptroller of the Currency. FinCEN assessed a $1.2 billion penalty for the bank's failure to mitigate and report priority national security risks. The OCC assessed a $750 million civil money penalty for a deficient and ineffective BSA/AML compliance program, a penalty the agency says is credited within FinCEN's $1.2 billion figure. OFAC announced an $11.6 million settlement agreement over apparent violations of sanctions programs including Iran, Russia, narcotics and global terrorism. The bank admitted it willfully violated the Bank Secrecy Act and failed to timely report more than $5 billion in suspicious transactions.

The Third-Largest Penalty in Treasury History

The Treasury Department said the enforcement actions impose more than $1.21 billion in penalties against Bank of America, the second-largest bank in the United States, for violations of anti-money laundering and sanctions laws. Treasury described the action as the third-largest penalty in its history. The Associated Press reported the total ranks behind a roughly $4 billion settlement in 2023 with Binance and an approximately $3 billion settlement with Canada-based TD Bank the following year. Treasury Secretary Scott Bessent said financial institutions are on the front lines of protecting economic and national security. "When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks," Bessent said. "Today's actions send a clear message that even the biggest financial institutions are not above the law." The OCC said its $750 million penalty is the largest civil money penalty in the agency's history.

The Bank Admits It Broke the Law

Treasury said the bank admits it willfully violated the 1970 Bank Secrecy Act, which requires banks to help the government detect and prevent money laundering. According to Treasury, the bank admitted it failed to implement and maintain an anti-money laundering program meeting the BSA's minimum requirements, failed to conduct due diligence for correspondent accounts for foreign financial institutions, and failed to file suspicious activity reports. The bank said in a statement that financial crime compliance is serious and that it is responsible for getting it right. "We worked with regulators to reach these penalty resolutions stemming from violations cited in the previously reported 2024 (Comptroller of the Currency) Consent Order and FinCEN's investigation," the bank said. The bank said it has invested billions of dollars in technology and dedicated thousands of employees to combat financial crime, and that its team is far along with and committed to completing the work required to address the issues raised by regulators.

More Than $5 Billion Never Reported

Treasury said the bank failed to timely report more than $5 billion in suspicious transactions. More than $1 billion of that total implicated national-security and other priority illicit-finance risks, according to Treasury, including Chinese Money Laundering Networks, fraud, and potential trade-based money laundering with a substantial nexus to the southwest border. The FinCEN consent order states the failures resulted in missed and delayed detection and reporting of over $5 billion of suspicious activity. The order states the bank failed to report over $600 million of transactions with indicia of potential trade-based money laundering involving salvaged vehicles, roughly one-third of which had a southwest-border nexus, and hundreds of millions of dollars of transactions consistent with a Chinese Money Laundering Network typology. Treasury said the bank prioritized its revenues and minimized the impact on its required compliance resources, and leaned on law-enforcement inquiries and requests from other financial institutions.

The Machine That Missed It

The FinCEN consent order identifies the bank's primary transaction monitoring system as a proprietary platform called Event Processor, designed in 2010 and described in the bank's own records as the first of its kind in the industry. EP consolidated individual alerts into Event Groups and did not send them to an investigator until the combined risk score reached a threshold of 20 points. That threshold, initially set by stakeholder judgment, remained in place until December 2023. Event Groups had to reach 20 points within 13 months of the oldest alert, and alerts older than 13 months were retired and no longer counted. In December 2023, after engagement with regulators, the bank lowered the threshold to either 10 or 12 points, cut the window from 13 months to four, and set a 5% false-negative tolerance. The order states the bank estimated the revised threshold would mean an increase of 16,000 U.S. investigations each month, double its prior ongoing monthly volume, requiring an incremental 750 personnel plus 800 consultants for a one-time lookback.

A Lookback That Found Almost 9,000 Missing Reports

A 2024 one-time lookback under the revised parameters found the bank had failed to identify and file nearly 8,900 suspicious activity reports, with transaction activity totaling nearly $4 billion, according to the FinCEN consent order. The order states the bank filed a material portion of its SARs more than six months after the relevant activity. For multiple years, more than one-third of the bank's suspicious activity investigations were prompted by external events — law-enforcement referrals, 314(a) and 314(b) requests, grand jury subpoenas — rather than its own automated controls. The consent order requires a third-party lookback to identify and report undetected suspicious transactions, plus independent reviews of suspicious-activity monitoring, customer due diligence, foreign correspondent account due diligence, and data governance. The order states the bank's AML program deficiencies extended to customer due diligence for high-risk customers that operated in the online auto auction industry.

The Warnings the Bank Did Not Heed

The OCC found the bank's deficient transaction monitoring system caused it to fail to properly monitor trillions of dollars in transactions and to file large numbers of late SARs involving billions of dollars, many with indicia of money laundering. The OCC said the bank knew for years it was failing to escalate potentially suspicious activity to investigators and failed to correct the violation. Its BSA officer and staff lacked sufficient skills and expertise, according to the OCC, and key BSA personnel did not receive appropriate training, resulting in inaccurate and late SARs. The OCC said the BSA audit function failed to identify long-standing concerns that examiners later uncovered. The FinCEN order states the violations generally continued throughout the relevant period despite repeated internal warnings from the bank's own compliance and testing personnel, as well as concerns raised by law enforcement and other financial institutions. The FinCEN order states that from 2018 to 2023, 76% of all risk-factor weights in EP stayed the same, and of the roughly 25% that changed, approximately 80% were decreases. Some cash-related risk factors carried a weight of one point despite measured SAR yields above 50%, according to the order.

The Order It Signed in 2024

The OCC said the bank is subject to a December 2024 cease-and-desist order requiring it to address its deficient BSA/AML compliance program. Comptroller of the Currency Jonathan V. Gould said the bank signed an order with the OCC almost two years ago and committed to fixing its longstanding BSA deficiencies. "Despite its obligation to the American people as a national-chartered, global systemically important bank, the bank's BSA/AML compliance program continues to reflect widespread breakdowns in internal controls, which threatens U.S. national and economic security," Gould said. He said the bank's poor response to its BSA deficiencies is unacceptable and that the second-largest bank's egregious and continued BSA violations warrant the OCC imposing its largest CMP ever assessed against a bank. The OCC said that after agreeing to the 2024 order, the bank still failed to prioritize BSA/AML compliance and, more than a year later, still failed to escalate potentially suspicious activity.

33,300 Wires With the Wrong Names Attached

The OCC found the bank sent outgoing wire transfers with inaccurate sender information, potentially harming law enforcement's ability to know who sent the money. Between November 2021 and October 2024, the bank processed roughly 33,300 such wires totaling about $1 billion, according to The Center Square. The bank identified the problem itself in April 2024 and stopped the practice that year, but does not know how long it had been going on, The Center Square reported. OCC examiners reviewing a small sample of accounts in the bank's $102 billion credit card portfolio found 10 showing signs of potential trade-based money laundering. At the agency's request the bank reviewed them and filed SARs covering hundreds of millions of dollars in transactions in five of them. Absent the OCC's request, the order states, "there is no indication that the Bank would have reviewed these accounts or filed these SARs."

The Bank Behind the Penalty

The FinCEN consent order identifies Bank of America as the primary bank subsidiary of Bank of America Corporation, a financial holding company based in Charlotte, North Carolina, traded on the New York Stock Exchange under the ticker "BAC." The order states the bank holds roughly $2.7 trillion in total assets and is a global systemically important bank with approximately 211,000 employees, more than 3,500 branches and about 15,000 ATM locations in the United States. Its most recent annual financial disclosure reported net income of approximately $30.5 billion, according to the order.

What the Bank Must Do Now

The consent order requires the independent reviews to be tailored to the violations and to evaluate how well the bank's anti-money laundering program addresses three priority risks: the U.S. southwest border, cartels and potential narcotics trafficking; Iran; and Russia. The order covers a relevant time period of at least 1 January 2018 through 1 July 2025. It states that a third-party report issued in June 2025, required by one of the bank's prudential regulators, contained findings consistent with FinCEN's investigation, and that the issues with EP remained unresolved as recently as June 2025. The bank said it has dedicated thousands of employees to combat financial crime and that its team is far along with and committed to completing the work required to address the issues raised by its regulators.

By Jessica Ali, Staff Writer

This article was produced with AI-assisted research and editorial support. Sources: U.S. Department of the Treasury, FinCEN, the Office of the Comptroller of the Currency, and The Associated Press.