The U.S. Department of the Treasury announced coordinated enforcement actions totaling more than $1.2 billion against Bank of America, the nation’s second-largest bank, for violations of anti-money laundering and sanctions laws. The penalties mark the third-largest in Treasury history and include the largest civil money penalty ever imposed by the Office of the Comptroller of the Currency.
The Financial Crimes Enforcement Network assessed a $1.2 billion penalty for the bank’s failure to mitigate and report priority national security risks, including Chinese money laundering networks and illicit finance along the southwest border. The OCC levied a $750 million civil money penalty, credited against the FinCEN assessment, for the bank’s deficient and ineffective Bank Secrecy Act/anti-money laundering compliance program. Separately, the Office of Foreign Assets Control reached an $11.6 million settlement over 475 apparent violations of sanctions programs targeting Iran, Russia, Belarus, Burma, Somalia, narcotics, and global terrorism.
As part of its resolution with FinCEN, Bank of America admitted that it willfully violated the Bank Secrecy Act. The bank failed to implement and maintain an AML program meeting minimum regulatory requirements, conduct adequate due diligence on correspondent accounts for foreign financial institutions, and file timely suspicious activity reports. These shortcomings resulted in the bank failing to timely report more than $5 billion in suspicious transactions to FinCEN, including more than $1 billion involving national security-related and other priority illicit finance risks such as Chinese money laundering networks, fraud, and potential trade-based money laundering with a substantial nexus to the southwest border.
Regulators described widespread problems in the bank’s transaction monitoring systems, which failed to properly monitor trillions of dollars in transactions and led to large numbers of late SARs involving billions of dollars, many with indicia of money laundering. The bank relied heavily on external inquiries from law enforcement and other financial institutions rather than robust internal controls. Issues included inadequate escalation of suspicious activity, gaps in customer due diligence that overlooked red flags such as potential narcotics trafficking proceeds, and shortcomings in staffing, training, and audit functions. These problems persisted despite a December 2024 OCC cease-and-desist order requiring the bank to fix longstanding BSA/AML deficiencies.
Treasury Secretary Scott Bessent stated: “Financial institutions are on the front lines of protecting our economic and national security. When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks. Today’s actions send a clear message that even the biggest financial institutions are not above the law.” Comptroller of the Currency Jonathan V. Gould highlighted the bank’s scale, processing hundreds of trillions of dollars in transactions annually, and its high risk profile, calling the continued breakdowns “unacceptable” and a threat to U.S. national and economic security.
In response, a Bank of America spokesperson said: “Financial crime compliance is serious, and we are responsible for getting it right. We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime, and our team is far along with and committed to completing the work required to address the issues raised by our regulators.” The bank will take a non-tax-deductible $1.2 billion charge in its third-quarter 2026 results (scheduled for release October 14), reducing net income by approximately 17 cents per share. Remedial measures include a third-party lookback to identify and report previously undetected suspicious activity, along with independent reviews of monitoring, due diligence, and data governance programs focused on priority risks such as the southwest border, cartels, narcotics, Iran, and Russia.
The actions underscore regulators’ expectations that systemically important banks maintain risk-based AML and sanctions compliance programs commensurate with their size and global operations, rather than prioritizing other considerations. Unlike some prior large FinCEN penalties—such as the $3.4 billion against Binance in 2023 or the $1.3 billion against TD Bank in 2024, no accompanying Justice Department criminal action was announced in this case. The enforcement serves as a high-profile reminder of the ongoing challenges large financial institutions face in detecting and reporting illicit activity that can intersect with national security concerns.