Bank of America Put Revenue First. Penalties Now Top $1.21 Billion

Bank of America’s own tests showed that its financial-crime monitoring system was missing activity that warranted reporting. The bank left weaknesses in place anyway. Now it has admitted willful violations of federal anti-money-laundering law, and civil penalties plus a sanctions settlement announced on October 13, 2026, total more than $1.21 billion. The sharpest finding is about a management choice, not a malfunction. ^{31 1}

That sentence turns an expensive compliance failure into a more consequential account of how the bank handled warnings. Internal testing, escalations and outside concerns did not produce adequate repairs. Significant corrective work also remained unfinished after a December 2024 cease-and-desist order from the Office of the Comptroller of the Currency, or OCC. The bank remains subject to that earlier order. ^{31 6}

The penalty arithmetic matters. The Financial Crimes Enforcement Network, known as FinCEN, assessed $1.2 billion. The OCC assessed $750 million, but payment of that amount is credited against FinCEN’s assessment, leaving a net $450 million payable under the FinCEN order. The OCC amount is not another fine to stack on top of $1.2 billion. ^{31 7}

The Office of Foreign Assets Control, or OFAC, separately agreed to an $11,662,930 sanctions settlement. Together, the stated amounts imply $1,211,662,930 without double counting. Treasury described the coordinated action as its third-largest penalty; the OCC’s assessment is the largest in that agency’s history. ^{10 1 6}

These are assessed civil penalties and agreed settlement terms, not merely penalties regulators are seeking. Bank of America admitted willful Bank Secrecy Act violations involving its anti-money-laundering program, required checks on correspondent accounts for foreign financial institutions, and suspicious-activity reporting. The OFAC case, by contrast, settles potential civil liability for apparent sanctions violations. Neither establishes a criminal conviction, and no accompanying Justice Department criminal action is established in the available record. ^{31 8}

FinCEN’s relevant period runs from at least January 1, 2018, through July 1, 2025, unless a particular finding specifies otherwise. More than $5 billion in suspicious activity went without timely detection and reporting, including more than $1 billion involving national-security or other priority risks. The smaller figure is included in the larger one. ³¹

Suspicious-activity reports, or SARs, alert investigators to possible wrongdoing; they do not prove it. The $5 billion is therefore not a finding that every dollar was criminal proceeds or that all the activity remained unreported forever. The failure was to deliver necessary warnings promptly.

A central weakness was the bank’s proprietary Event Processor system. It combined alerts into Event Groups, which generally needed a risk score of 20 points before investigation unless an automatic promotion rule intervened. That threshold rested on stakeholder judgment without adequate empirical support. Internal tests repeatedly found report-worthy activity below it; in several periods, groups just below 20 points produced higher SAR yields than groups meeting the cutoff. ³¹

The system initially used a 13-month window, later shortened, and retired older alerts from scoring. Risk factors were inadequately weighted, while rescoring and suppression could zero them out without sufficient governance. Coverage was limited for negotiable-instrument deposits, credit-card activity and trade-based money-laundering scenarios. External or manual promotion events frequently brought activity into investigation only after law enforcement or another bank raised concerns. ³¹

In plain language, the bank relied too heavily on someone else spotting the problem first. Activity could accumulate uninvestigated for extended periods, and some eventual reports had limited usefulness to investigators. Customer checks also failed to respond adequately to red flags despite escalations. ³¹

The risks included Chinese Money Laundering Networks, fraud, high-risk international wires and potential laundering through trade with a substantial southwest-border connection, including salvaged vehicles. Online auto-auction customers made third-party payments or used instruments potentially linked to narcotics proceeds. These were particular warning patterns requiring scrutiny, not proof that all such customers or cross-border commerce were criminal. ³¹

In December 2023, the bank lowered the investigation threshold to 10 or 12 points, depending on the group’s characteristics. A limited 2024 lookback then identified nearly 8,900 missed SARs covering nearly $4 billion in activity. The order also describes that same review as producing more than 8,000 filings totaling approximately $3.96 billion. These are overlapping descriptions of one review, not two discoveries to add together. The later filings demonstrate eventual reporting, not restoration of the time lost. ³¹

The OCC found broader weaknesses: deficient monitoring across trillions of dollars in transactions, potentially suspicious activity left un-escalated for years, inadequate staff expertise and training, audit failures, and management minimizing deficiencies. Trillions describes the transaction universe inadequately monitored—not an amount proved to have been laundered. ⁶

The separate sanctions case covers 475 apparent violations from September 18, 2021, through April 24, 2025, involving programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism. Technical and human errors, delayed watchlist updates and alert suppression let payments involving blocked banks through. The bank also failed to prioritize exact name-and-birth-date matches to blocked people. ¹⁰

OFAC classified the conduct as non-egregious but largely not voluntarily self-disclosed: 413 apparent violations were not self-disclosed and 62 were. It cited recklessness, prior cautionary letters and harm to sanctions objectives, particularly following Russia’s invasion of Ukraine. The settlement received no reduction from the base penalty for remediation or cooperation. “Non-egregious” is an enforcement classification, not a finding of harmlessness. ¹⁰

Bank of America’s response begins with responsibility: “Financial crime compliance is serious, and we are responsible for getting it right.” It says it has invested billions in technology, dedicated thousands of employees to combating financial crime and is far along with required corrective work. Those investments are the bank’s account; they do not independently demonstrate effective detection and timely reporting. ¹⁷

The bank says it will record a $1.2 billion non-tax-deductible charge in third-quarter 2026 results, reducing net income by approximately 17 cents per share. That is announced accounting treatment, not a completed earnings result or a stock-price decline. The charge equals roughly 3.9 percent of its official $30.509 billion net income for 2025. That comparison gives scale, not proof of deterrence. ^{61 67}

FinCEN now requires independent consultants to search for missed suspicious activity and assess monitoring, customer and foreign-correspondent due diligence, and anti-money-laundering data governance. Certain existing OCC consultants or lookbacks may be used only with FinCEN’s approval. ³¹

For the SAR lookback, the bank must propose a qualified consultant within 60 days of execution, with an intended hire within 30 days; FinCEN can veto the choice. A scope report is due within 150 days of engagement. The detailed lookback report is due within 18 months of that scope report and no later than December 2028, followed within 90 days by any further required SARs. The monitoring-effectiveness report is due within 45 days of review completion and no later than July 2028. Those final cutoffs specify months, not particular days. ³¹

The enforcement facts are settled; the repair is not. Writing the check will satisfy a financial obligation. Finding what the bank missed—and demonstrating that it will not keep missing it—is the harder test.

The primary record comprises Treasury’s announcement ^{1 5}, the OCC release and penalty order ^{6 7}, OFAC’s settlement page and enforcement release ^{8 10 42}, and FinCEN’s announcement, enforcement page and consent order ^{15 27 31 58}.

Supplied coverage includes SBS ², Bloomberg Television ³, PBS NewsHour ⁴, CNBC ⁹, American Banker ¹¹, AP ¹², CNN ¹³, The Financial Current ¹⁴, Axios ¹⁶, Reuters ¹⁷, Financial Times ¹⁸, UPI ¹⁹, Fox Business ²⁰, InvestmentNews ²¹, Yahoo Finance ²², ABC News ²³, USA Today ²⁴, IBTimes Australia ²⁵, Fincrime Central ²⁶, Newsweek ⁴⁸, Al Jazeera ⁴⁹, BBC ⁵⁹, AlphaPilot ⁶⁰, TipRanks ⁶¹, The Asian Banker ⁶², Futubull ⁶³ and Firstpost ⁷⁴.

Financial materials include SEC disclosures ^{50 56 67 72}, bank earnings and investor documents ^{52 53 55 57}, and supplementary financial references from BusinessQuant ⁵¹, Stockrow ⁵⁴, MarketScreener ^{64 66}, Yahoo Finance ^{65 70}, Seeking Alpha ⁶⁸, Eulerpool ⁶⁹, PublicNow ⁷¹ and Chartmill ⁷³.

The supplied bibliography also contains supplementary material not used to establish this action’s findings: an Eric Garland post ²⁸; FinCEN indexes ^{29 30}; OCC reference pages, documents and announcements ^{32 33 34 35 36 37 38 39}; Treasury’s release index ⁴⁰; OFAC reference pages ^{41 44 46}; and Treasury program, audit and risk-assessment documents ^{43 45 47}.