Bank of America faces $1.21bn in AML and sanctions penalties

The record

How the penalties add up

FinCEN assessed a $1.2 billion civil penalty. The OCC separately imposed $750 million, but that payment is credited against the FinCEN assessment. Page 67 of FinCEN’s consent order therefore specifies a remaining $450 million payment to Treasury. Adding the two headline fines would count the same $750 million twice. [2]

OFAC’s approximately $11.6 million settlement is additional. It resolves potential civil liability for 475 apparent sanctions violations involving several programmes, including Russia and Iran. The combined announced burden is consequently about $1.212 billion, rather than $1.962 billion. [1]

A compliance case with an earlier warning

The OCC had already issued a cease-and-desist order in December 2024. Its new assessment says the bank continued to suffer breakdowns in transaction monitoring, staff expertise and internal controls despite that intervention. The regulator describes the $750 million assessment as the largest in its history. [3]

Bank of America admitted willful BSA violations in resolving the FinCEN matter, including failures in its AML programme, foreign correspondent-account due diligence and suspicious-activity reporting. Those admissions belong to a civil regulatory resolution; they are not a criminal conviction for laundering the entire value of the transactions under review. [4]

The $5 billion figure measures reporting failures

Treasury says the bank failed to report more than $5 billion in suspicious transactions on time. That total is distinct from the fines and cannot be treated as proven criminal proceeds or a quantified loss to customers. [1]

The 95-page FinCEN order offers a more detailed account of the monitoring failures. It describes risk-scoring thresholds that allowed alerts to accumulate before investigators reviewed them, as well as excessive dependence on outside referrals. A limited retrospective review after changes to the system identified nearly $4 billion in previously missed suspicious activity; that finding should not be added to the broader $5 billion figure as a separate loss. [2]

The bank’s response and the next test

Bank of America told Reuters that it had invested billions in technology and assigned thousands of employees to financial-crime work. It said remedial work was well advanced and that it remained committed to completing the changes regulators required. [5]

The resolution also requires independent review and a retrospective search for transactions that should have been reported. These obligations make implementation the next stage of the case: payment of a penalty does not by itself demonstrate that the underlying monitoring problems have been corrected. [1] [2]

The central reporting question is whether future findings show that the bank can identify and escalate suspicious activity promptly. The published records establish the regulatory failures and agreed remedies; they do not establish that every customer transaction flagged by those failures was criminal.

Based on reporting from: US Treasury: coordinated enforcement actions, 13 October 2026; FinCEN consent order 2026-03, including penalty credit and undertakings; OCC: $750 million assessment, 13 October 2026; FinCEN: $1.2 billion penalty and bank admissions, 13 October 2026; Reuters: Bank of America response, 13 October 2026 (AOL syndication).