The US Treasury announced on 13 October 2026 what it called record enforcement actions against Bank of America, the second-largest bank in the United States, for breaking anti-money laundering and sanctions laws. In total, Treasury said, the actions impose “more than $1.21 billion in penalties.”
How the penalties fit together
Three parts of the US government acted together:
- FinCEN, the Treasury’s Financial Crimes Enforcement Network, assessed a $1.2 billion penalty for the bank’s “failure to mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border.”
- The OCC, the Office of the Comptroller of the Currency, which supervises national banks, imposed a $750 million civil money penalty for what Treasury called the bank’s “deficient and ineffective BSA/AML (anti-money laundering) compliance program.” The OCC says this is the largest penalty in its history.
- OFAC, the Office of Foreign Assets Control, which enforces US sanctions, reached an $11.6 million settlement with the bank.
The penalties do not simply add up. In its own release, the OCC said FinCEN “is assessing a $1.2 billion fine that credits the OCC’s $750 million penalty.” In other words, the OCC’s $750 million counts towards FinCEN’s $1.2 billion, and OFAC’s settlement comes on top. That is why the total is just over $1.21 billion. Treasury said the actions include “the third-largest penalty in Treasury history and the largest in the Office of the Comptroller of the Currency (OCC) history.”
What FinCEN found
The Bank Secrecy Act (BSA) is the main US anti-money laundering law. It requires banks to know their customers, watch for suspicious transactions and report them to FinCEN in suspicious activity reports (SARs).
Treasury said Bank of America “admits that it willfully violated the BSA” and failed to:
- run an anti-money laundering programme that met the law’s minimum requirements;
- carry out due diligence on accounts it held for foreign banks; and
- file suspicious activity reports.
According to Treasury, the bank leaned heavily on tips from law enforcement and other banks instead of its own automated checks, and so “effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations.” Suspicious activity was left to pile up uninvestigated for long periods, and the reports that were eventually filed came too late to be of much use to law enforcement. Treasury also said that, as these problems emerged, the bank “prioritized its revenues and minimized the impact on its required compliance resources,” and did not act meaningfully even after internal testing showed significant problems.
On customer checks, Treasury said the bank failed to account for customers relying heavily on payments from unknown third parties, and did not respond in time to “mounting red flags”, including possible links to drug trafficking proceeds, even after its own compliance staff raised concerns about possible trade-based money laundering and fraud.
The result, Treasury said, was that the bank failed to report on time “over $5 billion dollars in suspicious transactions.” More than $1 billion of that involved national security and other priority risks, including transactions suggesting Chinese money laundering networks, fraud and possible trade-based money laundering with strong links to the US southwest border.
What the OCC found
The OCC said the bank’s monitoring system led it to fail to properly watch “trillions of dollars in transactions,” causing large numbers of late suspicious activity reports involving billions of dollars. It said the bank knew for years that it was not passing potentially suspicious activity to investigators, but did not fix the problem.
The OCC also said the bank’s BSA Officer and staff “lacked sufficient skills and expertise” to run the programme, key staff were not properly trained, and the bank’s internal audit missed long-standing problems that examiners later found.
The bank was already under a December 2024 cease-and-desist order requiring it to fix its anti-money laundering programme. The OCC said that more than a year after that order, the bank was still failing to pass potentially suspicious activity to investigators, and it processed possible trade-based money laundering transactions because of a “systemic gap” in its monitoring.
“The bank’s poor response to its BSA deficiencies is unacceptable,” said Comptroller of the Currency Jonathan V. Gould.
The sanctions settlement
OFAC said the bank settled 475 apparent violations of several sanctions programmes. Treasury said these happened when the bank routed payments through blocked banks, let sanctioned individuals make payments and withdraw money because its alerts were poorly set, was slow to update its watchlists, and mishandled accounts linked to blocked people. As a result, it processed millions of dollars in payments that apparently broke sanctions on Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism. OFAC judged the violations “non-egregious and largely not voluntarily self-disclosed.”
What the bank must do now
Under FinCEN’s consent order, Bank of America must work with an outside firm to look back through past transactions and report suspicious activity it missed. It must also face independent reviews of its suspicious activity monitoring, customer checks, due diligence on foreign bank accounts and the data its anti-money laundering programme relies on. Treasury said those reviews will focus on risks linked to the US southwest border, cartels and drug trafficking, Iran and Russia.
“Today’s actions send a clear message that even the biggest financial institutions are not above the law,” said Treasury Secretary Scott Bessent.
What this means
- The headline total is about $1.21 billion, not almost $2 billion, because the OCC’s $750 million is credited towards FinCEN’s $1.2 billion.
- The bank admitted wilful violations of the Bank Secrecy Act, according to Treasury.
- Regulators are warning other banks not to rely on tips from outside instead of their own monitoring, and not to sit on red flags.
Sources
- US Department of the Treasury, “U.S. Treasury Announces Record Enforcement Actions Against Bank of America”, 13 October 2026. https://home.treasury.gov/news/press-releases/sb0657/
- Office of the Comptroller of the Currency, “OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance”, News Release 2026-89, 13 October 2026. https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-89.html
