US authorities on Tuesday levied more than $1.21 billion in penalties against Bank of America (NYSE: BAC) for violations of anti-money laundering and sanctions requirements covering activity from 2018 through July 2025.
The actions, coordinated among the Financial Crimes Enforcement Network, the Office of the Comptroller of the Currency (OCC), and the Office of Foreign Assets Control (OFAC), include the third-largest penalty in Treasury Department history and the largest civil money penalty ever imposed by the OCC.
FinCEN assessed a $1.2 billion penalty after concluding that the bank willfully violated the Bank Secrecy Act by failing to maintain an adequate AML program, conduct required due diligence on correspondent accounts for foreign financial institutions, and file suspicious activity reports.
The OCC imposed a $750 million civil money penalty—credited toward the FinCEN total—for a deficient and ineffective BSA/AML compliance program. OFAC separately reached an $11.6 million settlement covering 475 apparent violations of sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics trafficking, and global terrorism.
Those apparent violations included processing payments involving blocked banks, inadequate prioritization of sanctions alerts, delays in updating watchlists, and human errors involving accounts linked to blocked persons.
As part of the FinCEN resolution, Bank of America admitted the willful BSA violations. Investigators found that deficiencies in transaction monitoring and customer due diligence led the bank to fail to timely report more than $5 billion in suspicious transactions.
More than $1 billion of that activity implicated national-security and other priority illicit-finance risks, including patterns consistent with Chinese money-laundering networks, fraud, and potential trade-based money laundering with a substantial nexus to the southwest border.
Regulators stated that the bank had prioritized revenue considerations and limited the resources devoted to compliance, relying excessively on external inquiries from law enforcement and other institutions rather than robust internal controls.
Late or incomplete reporting reduced the practical utility of the information for investigators.
This is not the first regulatory intervention targeting the bank’s controls.
In December 2024 the OCC issued a cease-and-desist order citing failures to file SARs on a timely basis, shortcomings in customer due diligence, and weaknesses across internal controls, governance, independent testing, and training.
Despite that order and commitments to remediate, examiners found that significant deficiencies persisted, including continued failure to escalate potentially suspicious activity for investigation and gaps that allowed processing of potential trade-based money laundering transactions.
The bank’s transaction-monitoring systems had not properly covered trillions of dollars in activity, producing large volumes of late SARs, many of which carried indicators of money laundering.
Under the Bank Secrecy Act and implementing regulations, financial institutions generally must file a suspicious activity report for transactions (or related patterns) aggregating $5,000 or more when they know, suspect, or have reason to suspect that the activity involves funds derived from illegal activity, is structured to evade reporting requirements, lacks an apparent lawful purpose given the customer’s profile, or facilitates criminal conduct.
Red flags can include unusual third-party payments, activity inconsistent with known business or personal patterns, rapid movement of funds through multiple accounts, or links to high-risk jurisdictions or counterparties.
When such reporting is delayed or omitted, authorities lose timely visibility into potential money laundering, sanctions evasion, narcotics proceeds, or other illicit flows.
In this case, the unreported volume included activity tied to networks that regulators view as priority national security threats, raising concerns that gaps at a systemically important institution can amplify risks across the broader financial system.
These challenges are not unique to Bank of America.
Large banks process enormous transaction volumes across complex correspondent relationships, legacy technology stacks, and global customer bases, making comprehensive monitoring resource-intensive and prone to alert fatigue or calibration errors.
Balancing commercial priorities against compliance investment has repeatedly drawn scrutiny.
Leaner fintechs and digital platforms often deploy more modern, API-driven monitoring and can onboard customers rapidly, yet they face their own pressures: scaling controls in line with explosive growth, limited historical data for model training, and heightened expectations when partnering with chartered banks.
Recent supervisory focus on bank-fintech arrangements has highlighted cases in which sponsor banks were cited for inadequate oversight of partners’ onboarding and monitoring practices.
Both traditional institutions and newer entrants must continuously refine customer due diligence, beneficial-ownership verification, and transaction surveillance as risk typologies evolve.
Under the consent order, Bank of America must engage a third party for a lookback review to identify and report previously undetected suspicious activity, and it must undergo independent assessments of its monitoring, due-diligence, and data governance frameworks, with particular attention to priority risks.
The bank has stated that its teams are advanced in remediation efforts. The penalties underscore ongoing regulatory insistence that institutions of every size maintain effective, integrated AML and sanctions controls commensurate with their risk profiles.