Bank of America Faces Record Treasury Penalties Over Anti-Money Laundering and Sanctions Failures

Key Takeaways

• Record Treasury Enforcement Actions: The U.S. Treasury announced more than $1.21 billion in combined penalties against Bank of America for anti-money laundering and sanctions compliance failures, including record enforcement action by the OCC.
• Billions in Suspicious Transactions: Bank of America failed to report more than $5 billion in suspicious transactions in a timely manner, including over $1 billion involving national security concerns and other priority illicit finance risks.
• Longstanding Compliance Deficiencies: Regulators found that the bank's transaction monitoring systems failed to properly monitor trillions of dollars in transactions, while significant weaknesses persisted despite a December 2024 cease-and-desist order.
• Hundreds of Apparent Sanctions Violations: Bank of America agreed to an $11.6 million OFAC settlement covering 475 apparent violations involving sanctions programs targeting Russia, Iran, Belarus, and other jurisdictions and activities.
• Independent Reviews Required: The bank must conduct a retrospective review of previously undetected suspicious transactions and undergo independent assessments of its anti-money laundering controls, customer due diligence, and data governance.

Deep Dive

Bank of America failed to report more than $5 billion in suspicious transactions in a timely manner and allowed serious deficiencies in its anti-money laundering controls to persist for years, even after regulators ordered the bank to correct them, according to enforcement actions announced Tuesday by the U.S. Treasury Department.

The October 13 actions carry more than $1.21 billion in combined penalties, including a $1.2 billion assessment by the Financial Crimes Enforcement Network (FinCEN), a record $750 million civil money penalty from the Office of the Comptroller of the Currency (OCC), and an $11.6 million settlement with the Office of Foreign Assets Control (OFAC). The FinCEN assessment is the third-largest penalty in Treasury history, while the OCC's is the largest in that agency's history.

The investigations found extensive weaknesses in Bank of America's ability to identify, investigate, and report suspicious financial activity. Transactions went unexamined for extended periods, internal warnings failed to produce adequate corrective action, and the bank increasingly depended on law enforcement inquiries and information from other financial institutions to identify activity its own monitoring systems had missed.

More than $1 billion of the suspicious transactions that went unreported within the required timeframes involved national security concerns and other priority illicit finance risks, including activity indicative of Chinese Money Laundering Networks, possible trade-based money laundering, and transactions with substantial connections to the U.S. southwest border.

“Financial institutions are on the front lines of protecting our economic and national security,” Treasury Secretary Scott Bessent said. “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks.”

Bank of America admitted as part of its resolution with FinCEN that it had willfully violated the Bank Secrecy Act by failing to maintain a compliant anti-money laundering program, conduct required due diligence on correspondent accounts for foreign financial institutions, and file suspicious activity reports.

FinCEN found that the bank had placed revenue considerations ahead of the resources needed to meet its compliance obligations. Testing had identified serious problems with its transaction monitoring systems, but the bank failed to make meaningful improvements.

The deficiencies were particularly apparent in its handling of customer relationships involving extensive payments from unidentified third parties. According to Treasury, the bank's due diligence procedures failed to adequately account for these arrangements, even as concerns mounted about possible fraud, trade-based money laundering, and transactions potentially connected to narcotics trafficking proceeds.

Compliance personnel escalated some of those concerns, but the bank did not respond promptly or meaningfully. Suspicious activity continued to accumulate without investigation, and reports eventually submitted to FinCEN were often too late to be as useful to law enforcement as timely filings would have been.

FinCEN also found that Bank of America had come to rely heavily on outside intervention to identify potentially suspicious transactions. Law enforcement inquiries, referrals from other financial institutions, and similar requests were performing work that the bank's internal controls should have undertaken independently.

The resulting failures extended across billions of dollars in transactions. In addition to the reporting violations, FinCEN identified deficiencies in customer due diligence and the oversight of foreign correspondent banking relationships.

Compliance Problems Persisted After a 2024 Order

The OCC's investigation established that many of the weaknesses had been known for years. In December 2024, the regulator issued a cease-and-desist order requiring Bank of America to address deficiencies in its Bank Secrecy Act and anti-money laundering program. More than a year later, significant corrective measures remained incomplete.

According to the OCC, the bank's transaction monitoring system failed to properly monitor trillions of dollars in transactions. The failures contributed to large numbers of late suspicious activity reports involving billions of dollars, many containing indicators of money laundering.

The bank had known for years that potentially suspicious transactions were not being escalated to investigators for review. The OCC found that management failed to correct the problem despite its seriousness and the requirements imposed under the earlier enforcement order.

The regulator also identified deficiencies among the personnel responsible for managing the program. The bank's Bank Secrecy Act officer and supporting staff lacked sufficient skills and expertise, while key employees had not received appropriate training in identifying, investigating, and reporting suspicious activity.

Those weaknesses contributed to inaccurate and late reports. Internal audit also failed to identify longstanding compliance problems subsequently uncovered by OCC examiners.

The December 2024 order had required the bank to strengthen its program, but the OCC found that management continued to minimize the extent of the deficiencies. Potentially suspicious activity was still not consistently reaching investigators more than a year after the order was issued. The regulator also identified a systemic gap in transaction monitoring that allowed the bank to process transactions potentially involving trade-based money laundering.

The $750 million OCC penalty addresses violations of the Bank Secrecy Act and its implementing regulations, including requirements governing compliance programs and suspicious activity reporting.

Sanctions Violations Involved Hundreds of Transactions

A separate OFAC investigation identified 475 apparent violations of U.S. sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics trafficking, and global terrorism. Bank of America agreed to pay $11.6 million to settle its potential civil liability for the apparent violations, which involved millions of dollars in payments.

The transactions were processed through a combination of technical failures, human errors, and weaknesses in sanctions screening procedures. According to OFAC, Bank of America routed correspondent banking payments through blocked banks, allowed designated individuals to make payments and withdraw funds, and failed to update sanctions watchlists promptly following new designations.

Poorly calibrated sanctions alerts contributed to the failures, as did errors involving business accounts associated with blocked persons. OFAC classified the apparent violations as non-egregious and determined that they had largely not been voluntarily self-disclosed.

The settlement reflected no reduction from the base penalty, including no mitigation for remedial measures or cooperation. As part of the agreement, Bank of America made compliance commitments involving employee training, testing, auditing, and future communication and cooperation with OFAC.

The sanctions findings came alongside the broader deficiencies identified by FinCEN and the OCC, exposing weaknesses in several of the bank's principal financial crime compliance functions.

Treasury emphasized the need for financial institutions to maintain coordinated anti-money laundering and sanctions controls, particularly where the risks associated with illicit finance and prohibited transactions overlap.

Independent Reviews Will Examine the Bank's Controls

Bank of America must now undertake a retrospective review of transactions that may have escaped detection because of its compliance failures.Under FinCEN's consent order, the bank must work with a third party to identify suspicious transactions that went undetected and report them to the regulator.

It must also undergo independent reviews of its transaction monitoring, customer due diligence, and foreign correspondent account due diligence programs. The reviews will examine the bank's data governance framework as it relates to information used in its anti-money laundering program.

The assessments will pay particular attention to risks involving the U.S. southwest border, cartels, potential narcotics trafficking, Iran, and Russia. Treasury said financial institutions must maintain risk-based compliance programs appropriate to their size, operations, and exposure to illicit finance. It also warned that identifying problems internally is insufficient when those findings are not followed by timely corrective action.

Customer due diligence procedures must account for changes in a customer's activity and risk profile, while transaction monitoring systems must be capable of identifying suspicious activity without depending on referrals from outside institutions.

For Bank of America, the required reviews will examine problems that had already been identified through internal testing, regulatory examinations, and the December 2024 enforcement order. The OCC found that substantial deficiencies remained even after the bank had been formally directed to address them.

The work now required under FinCEN's consent order will determine whether the bank's monitoring systems, customer due diligence procedures, and supporting data controls can identify the activity that regulators found had gone undetected for years.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey