On October 13, the Financial Crimes Enforcement Network (“FinCEN”), the Office of the Comptroller of the Currency (“OCC”), and the Office of Foreign Assets Control (“OFAC”) announced coordinated enforcement actions imposing more than $1.21 billion in penalties against Bank of America, N.A. (“Bank of America” or “the Bank”), for violations of anti-money laundering and sanctions laws.¹

As the coordinated actions against Bank of America demonstrate, financial institutions should not mistake the administration’s pragmatic approach to anti-money laundering enforcement for a no-enforcement policy. Where a financial institution’s AML program has core program deficiencies, it must remediate identified gaps and weaknesses. The administration remains focused on these core BSA/AML violations, particularly those with a nexus to national security and trade-based money laundering schemes connected to the southwest border. The enforcement actions include the third-largest penalty in Treasury history and the largest in the history of the OCC.²  

In the wake of this resolution, financial institutions should review the findings and incorporate the lessons into their BSA/AML program:

• Calibrate monitoring to risk, not to staffing. FinCEN found that Bank of America’s management focused on resourcing rather than remediation, and that the Bank likely saved hundreds of millions of dollars in compliance costs; when it finally lowered its transaction monitoring system thresholds, the Bank projected doubling investigation volume and needing roughly 750 additional personnel. Thresholds and risk weights should be empirically supported, documented and revisited as the risk profile evolves, with an objective false-negative tolerance, something the Bank lacked for most of the relevant period.
• Act on your own testing. Here, the Bank’s validation reports repeatedly flagged miscalibrated weights and below-threshold SAR yields. Yet the Bank’s 2021 recalibration produced a net decrease in risk weights and was framed around “case load reduction” with “permissible” SAR loss. Ensure testing is being used to enhance monitoring based on risk profile. Testing should never be rerun simply because its results are unwelcome.
• Do not outsource detection. Banks cannot primarily rely on law enforcement inquiries or referrals from other institutions instead of internal monitoring. A high share of externally triggered cases should itself be treated as a warning that coverage is deficient. Review alert statistics to ensure high-risk activity is being detected in-house. 
• Close product coverage gaps. Tens of billions of dollars in negotiable instrument deposits by high-risk customers went effectively unmonitored, and the Bank did not distinguish money orders from other instruments. Financial institutions should conduct periodic coverage assessments mapping products and channels to surface gaps.
• Let customer risk profiles drive monitoring. The Bank’s risk ratings tracked subpoenas rather than its own assessment, and quarterly reviews omitted money order activity and geographic trends. FinCEN noted that account closure is not the only option; enhanced monitoring and product restrictions are acceptable, but some commensurate response is required.
• Empower compliance. The order highlights that compliance recommendations to exit a customer were softened in favor of revenue, and that risks persisted after escalation to the BSA Officer and the head of the business line. Institutions should ensure that escalated compliance recommendations are resolved by a documented, independent governance process.
• Integrate AML and sanctions compliance. Treasury stressed that given converging risks, AML and sanctions programs should be “effectively integrated and mutually reinforcing.” OFAC gave Bank of America no mitigation credit for remediation or cooperation, and FinCEN faulted unreasonable production delays; a public reminder that cooperation credit must be earned.

Introduction
In this action, three Treasury components acted in concert. FinCEN assessed a $1.2 billion civil money penalty under a consent order in which the Bank admitted willfully violating³ the Bank Secrecy Act, or BSA. The OCC assessed a $750 million civil money penalty (which FinCEN credited against its own penalty) for a deficient and ineffective BSA/AML compliance program, building off of a December 2024 cease-and-desist order. And OFAC announced an $11.6 million settlement for 475 apparent sanctions violations.⁴

The resolution is a reminder that sophisticated monitoring technology is no substitute for empirically grounded calibration, responsive testing and a compliance function empowered to act. As Treasury put it, financial institutions “cannot disregard mounting red flags or internal warnings about ineffective controls, whether under the guise of innovation or otherwise.”⁵

The Consent Order
FinCEN’s consent order rests on the Bank’s admission that it willfully violated the BSA from at least January 1, 2018, through July 1, 2025.⁶  FinCEN found three categories of violations: failure to maintain an AML program meeting the BSA’s minimum requirements, failure to conduct due diligence on correspondent accounts for foreign financial institutions, and failure to file timely and accurate suspicious activity reports, or SARs.⁷  Additionally, the OCC found that the Bank’s BSA Officer and staff lacked sufficient expertise and training, and that more than a year after the 2024 order the Bank was still failing to escalate alerts.

The Event Processor Problem
At the center of the order is Event Processor, or “EP,” the Bank’s proprietary transaction monitoring system.⁸  EP generally did not route individual alerts to investigators; instead, it scored alerts, grouped them at the customer level, and opened a case only once a group reached 20 points within 13 months. This was a threshold “initially set by stakeholder judgment” that remained in place until December 2023.⁹ Internal testing repeatedly showed that certain high-risk factors were assigned just one point instead of points tailored to the risk profile. Therefore, points did not necessarily accurately account for the group’s risk profile. For example, groups scoring just below the 20-point threshold produced SAR yields ranging from 38% to 45%.¹⁰  

In 2023, the Bank’s then-global head of financial crimes directed a senior manager to repeat an unfavorable test that highlighted control gaps. The rerun test concluded that EP was “working as intended.”¹¹  After the Bank lowered the threshold, a one-time lookback identified nearly 8,900 missed SARs involving nearly $4 billion in activity.¹²

FinCEN also found that EP provided only limited coverage of negotiable instrument deposits and that, for several years, more than one-third of the Bank’s investigations were prompted by law enforcement inquiries, subpoenas and other external events rather than its own controls.¹³ 

Customer Due Diligence and SAR Reporting Failures
The order frames the Bank’s reporting failures as a national security problem and ties them to Treasury’s stated priorities. The Bank failed to timely report more than $5 billion in suspicious transactions. More than $1 billion of that activity implicated “national security-related and other priority illicit finance risks,” including Chinese Money Laundering Networks (“CMLNs”), fraud, and potential trade-based money laundering (“TBML”) with a “substantial nexus to the southwest border.”¹⁴

The TBML findings center on two online auto auction customers. Between October 2020 and May 2025, those customers received more than 680,000 money orders forming roughly 220,000 suspicious groups totaling over $660 million. The orders were often sequential, round-dollar instruments totaling just under the $3,000 identification threshold, with about one-third tied to the southwest border.  That pattern fit a known TBML scheme in which illicit proceeds buy vehicles that are then exported abroad. The same customers received nearly $1 billion in suspicious “wires primarily involve[ing] Georgia, Belarus, and other Commonwealth of Independent States (CIS) nations.”¹⁵  Compliance personnel recommended closing one customer’s accounts in 2022, citing more than 100 AML cases and the Bank’s inability to understand its source of funds, but the relationship team, describing it as “a large and valued client,” pushed back, and a March 2023 mitigation plan was adopted instead.¹⁶ 

Separately, the Bank failed to timely report hundreds of millions of dollars in transactions bearing CMLN hallmarks. Customers claiming to be in logistics or electronics made back-to-back credit card purchases. They paid off third-party credit cards held by unrelated individuals and wired funds to Chinese counterparties “for goods.” Many of these transactions went through after the Bank had already lowered its monitoring thresholds.¹⁷  

Correspondent Accounts and Sanctions
Until late 2024, the Bank applied “simplified” due diligence to correspondent accounts for its own foreign branches and affiliates, even though those offices served more than 250 nonbank financial institutions.¹⁸ Separately, OFAC found 475 apparent violations across programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism, stemming from issues such as poor alert calibration and delayed watchlist updates.¹⁹ 

Penalty and Undertakings
As previously discussed, Treasury imposed a penalty of $1.2 billion against Bank of America. In addition, under the consent order, the Bank must also: 

• Conduct a SAR lookback. An independent consultant (the “SAR Lookback Consultant”) must review customer activity from January 2022 onward and give priority to the southwest border, CMLN, Iran, and Russia. The Bank must file every SAR that is identified, with the final report due by December 2028. 
• Test its suspicious activity monitoring. A consultant (the “Suspicious Activity Monitoring Consultant”) must first test the Bank’s interim controls while the EP system is being fixed, then test the rebuilt monitoring program once remediation is complete. The final report is due by July 2028, and the Bank must adopt a plan to implement the recommendations. 
• Test its customer due diligence and foreign correspondent diligence. A consultant (the “CDD and Foreign Correspondent Due Diligence Program Consultant”) must test how the Bank handles high-risk customers and the correspondent accounts of foreign financial institutions, including the Bank's own foreign branches and affiliates. The Bank must then implement the recommendations, and the consultant must verify that it did. 
• Review its AML data governance. A consultant (the “Data Governance Consultant”) must assess whether the data feeding the AML program is accurate, complete, and timely, and must report within one year.

FinCEN agreed to let Bank of America propose a “qualified independent consultant” for each of these consultancies subject to FinCEN’s right to veto the engagement. The December 2024 OCC Cease-and-Desist Order already requires Bank of America to engage independent consultants, including for historical SAR reviews. Subject to FinCEN approval, that same consultant “may also serve as the independent consultant for one or more Undertakings required under Sections VI.B, VI.C, or VI.D.”²⁰
 

---

^1. U.S. Dep’t of the Treasury, Press Release, U.S. Treasury Announces Record Enforcement Actions Against Bank of America (Oct. 13, 2026) (“Treasury Release”). Specifically, the government cited the following violations: failure to maintain an AML program, 31 U.S.C. § 5318(h) and 31 C.F.R. § 1020.210(a); failure to conduct foreign correspondent due diligence, § 5318(i) and § 1010.610; and failure to file timely and accurate SARs, § 5318(g) and § 1020.320.
^2. Id.
^3. The admission is “only as the term is used in civil enforcement,” which means reckless disregard or willful blindness.
^4.Treasury Release; see also OCC, News Release 2026-89 (Oct. 13, 2026); Consent Order Imposing Civil Money Penalty, In the Matter of Bank of America, N.A., No. 2026-03 (FinCEN) (“Consent Order”). Treasury’s release states the settlement was $11.6 million while the Consent Order says $11 million.
^5. Treasury Release.
^6. Consent Order §§ II, VII.
^7. Id. § III.
^8. Id. § II.D.1. EP was first implemented in 2010.
^9. Id.
^10. Id. § II.D.1.a, c. That is roughly seven to nine times the 5% tolerance for missed suspicious activity that the Bank adopted toward the end of the relevant time period.
^11. Id.
^12. Id. § II.D.1.
^13. Id. § II.D.1.d–e.
^14. Id. § II.F.1.
^15. Id. § II.D.2. Most of those wires came after Russia's February 2022 invasion of Ukraine, while FinCEN was warning publicly about sanctions-evasion risks in the auto industry. Id.
^16. Id. § II.D.3.b.
^17. Id. § II.F.3. FinCEN’s August 2025 advisory on CMLNs laundering proceeds for Mexico-based cartels flagged these same credit card red flags. Id. § II.D.1.e.
^18. Id. § II.E.
^19. See Treasury Release.
^20. Consent Order § VI.