Bank of America Faces $1.2 Billion FinCEN Penalty Over AML Failures

The US Financial Crimes Enforcement Network (FinCEN) has assessed a $1.2 billion civil money penalty against Bank of America, N.A., over violations of anti-money laundering requirements, including failures to investigate suspicious activity and submit timely reports to authorities.

Announced on October 13, 2026, the action was coordinated with the Office of the Comptroller of the Currency (OCC), which imposed a separate $750 million civil money penalty, and the Office of Foreign Assets Control (OFAC), which reached an $11.6 million settlement with the bank over apparent sanctions violations.

The combined enforcement actions exceed $1.21 billion. The FinCEN penalty credits the $750 million OCC penalty, leaving $450 million payable under FinCEN’s order. The OCC described its penalty as the largest in the agency’s history.

The regulators identified serious deficiencies in Bank of America’s Bank Secrecy Act and anti-money laundering (BSA/AML) programme, including weaknesses in transaction monitoring, customer due diligence, suspicious activity reporting and the handling of risks associated with foreign correspondent accounts.

FinCEN found that the bank failed to report suspicious transactions totalling more than $5 billion in a timely manner. More than $1 billion of this activity involved national security and other priority illicit finance risks, including suspected Chinese money laundering networks, fraud and potential trade-based money laundering linked to the US southwest border.

The relevant conduct covered the period from at least January 2018 through July 2025. Regulators said suspicious activity accumulated for extended periods without adequate investigation, resulting in reports that were late and of limited usefulness to law enforcement.

Bank of America admitted the facts and violations set out in FinCEN’s consent order, including willful violations of the Bank Secrecy Act. The order requires the bank to take corrective action and improve its financial crime controls.

One of the central deficiencies concerned the bank’s escalation procedures. Regulators found that Bank of America had known for years that potentially suspicious activity was not being referred promptly to investigators for review. Despite testing that identified significant problems, the bank failed to take sufficient corrective action.

The OCC also identified weaknesses in the bank’s BSA/AML staffing and expertise. Key compliance personnel lacked appropriate training in identifying, investigating and reporting suspicious activity, while the independent audit function failed to detect longstanding problems subsequently identified by examiners.

Customer due diligence was another area of concern. Regulators found that the bank did not adequately account for customers’ extensive reliance on payments from unknown third parties. This limited its ability to assess the nature and purpose of certain transactions and respond appropriately to warning signs, including possible links to narcotics trafficking proceeds.

The bank also processed transactions potentially indicative of trade-based money laundering because of a systemic gap in its transaction-monitoring programme. Concerns had previously been escalated by compliance personnel in relation to possible trade-based money laundering and fraud, but management did not ensure that the programme adequately addressed the identified risks.

The enforcement action also addresses the bank’s handling of foreign correspondent accounts. FinCEN found that Bank of America failed to conduct required due diligence for correspondent accounts maintained for foreign financial institutions, weakening controls intended to identify and manage risks associated with international financial flows.

Under the FinCEN order, Bank of America must work with an independent third party to review historical transactions and identify suspicious activity that may have gone undetected because of the failures. The bank must report relevant findings to FinCEN.

The bank must also undergo independent reviews of its suspicious activity monitoring, customer due diligence and foreign correspondent account due diligence programmes. A further review will assess the effectiveness of its data governance framework as it relates to information used in the AML programme.

These reviews must specifically consider risks associated with the US southwest border, drug cartels and potential narcotics trafficking, as well as Iran and Russia. The measures are intended to determine whether the bank’s systems can identify relevant risks and whether the information used for monitoring and reporting is sufficiently reliable.

The OCC’s separate $750 million penalty followed its conclusion that Bank of America had not made adequate progress in correcting deficiencies covered by a December 2024 cease-and-desist order. The regulator said significant weaknesses persisted more than a year after that order, including failures to escalate potentially suspicious transactions for investigation.

The OCC stated that the bank’s management had not ensured the implementation of an effective BSA/AML compliance programme and had continued to minimise the significance of the deficiencies. The latest penalty is intended to address violations of the Bank Secrecy Act and its implementing regulations.

Separately, OFAC reached an $11.6 million settlement with Bank of America concerning apparent violations of multiple US sanctions programmes, including those relating to Iran, Russia, narcotics and international terrorism. This settlement concerns sanctions compliance and is distinct from the AML penalties imposed by FinCEN and the OCC.

The enforcement measures require Bank of America to strengthen its compliance arrangements, improve the handling of suspicious activity and demonstrate that the weaknesses identified by regulators have been addressed. The independent reviews will provide an additional assessment of whether the bank’s controls are effective in practice.

The case highlights the consequences of prolonged deficiencies in transaction monitoring and suspicious activity reporting at a major financial institution. Regulators emphasised that identifying potentially suspicious transactions is not sufficient on its own: banks must investigate relevant alerts, escalate concerns appropriately and submit accurate reports within the required timeframes.

The corrective process will remain subject to regulatory oversight, with Bank of America required to address the identified shortcomings and improve its ability to detect and report financial activity associated with money laundering and other illicit finance risks.

By fLEXI tEAM