Three federal agencies say the nation’s second-largest bank admitted a willful Bank Secrecy Act violation, missed more than $5 billion in suspicious activity and kept failing after a 2024 order to fix it.
Bank of America has agreed to a combined penalty package of more than $1.21 billion after three federal agencies concluded that its anti-money-laundering controls failed to flag, escalate or report billions of dollars in suspicious transactions. The bank admitted to willfully violating the Bank Secrecy Act, according to FinCEN’s announcement on October 13, 2026.
The Treasury Department’s release describes the action as the third-largest penalty in Treasury history and, in the Office of the Comptroller of the Currency’s portion, the largest in that regulator’s history. Treasury says the bank failed to timely report to FinCEN more than $5 billion in suspicious transactions, including more than $1 billion tied to priority national-security risks such as Chinese money laundering networks, fraud and potential trade-based money laundering with a southwest border nexus.
The record shows a bank that, by its regulators’ account, knew about gaps in its monitoring for years and was still falling short more than a year after a formal order demanded repairs. Bank of America says it is fixing the deficiencies. The documents below lay out what each agency found.
Three Agencies, Three Penalties, One Pattern
The enforcement package has three components, each from a different agency with a different legal authority:
- FinCEN: $1.2 billion. The bureau’s resolution says the bank failed to maintain an anti-money-laundering program meeting the Bank Secrecy Act’s minimum requirements, failed to perform required due diligence on correspondent accounts for foreign financial institutions, and failed to file suspicious activity reports.
- OCC: $750 million. In News Release 2026-89, the OCC called its penalty the largest in the agency’s history. The release states that FinCEN’s $1.2 billion assessment credits the OCC amount, meaning the two figures are not stacked on top of each other.
- OFAC: about $11.66 million. A separate OFAC enforcement release covers 475 apparent sanctions violations.
That arithmetic explains the headline figure. The $1.2 billion FinCEN penalty, which absorbs the OCC payment, plus OFAC’s roughly $11.66 million, produces the “more than $1.21 billion” total Treasury cites.
What Regulators Say Went Wrong
The OCC’s findings are the most pointed. According to the agency, the bank’s transaction monitoring system failed to properly monitor trillions of dollars in transactions, leading to late suspicious activity reports covering billions of dollars, many of them showing indications of money laundering. The OCC states that the bank knew for years it was not escalating potentially suspicious activity to investigators but did not fix the problem.
The agency also found that the bank’s BSA officer and staff lacked sufficient skills, that key personnel were not properly trained, and that the internal audit function missed long-standing concerns that examiners later identified. Comptroller Jonathan V. Gould said the program “continues to reflect widespread breakdowns in internal controls” and called the bank’s response to its deficiencies “unacceptable.”
FinCEN’s account adds detail on how the bank detected problems. Treasury says the bank relied heavily on law enforcement inquiries and requests from other institutions, rather than its own automated controls, to identify suspicious activity, and allowed alerts to sit uninvestigated for long periods. Its customer due diligence also overlooked heavy reliance on payments from unknown third parties, including possible narcotics-trafficking proceeds, according to the release.
The Chinese Money Laundering Network Exposure
Treasury’s release says more than $1 billion of the unreported activity was indicative of Chinese money laundering networks, fraud and potential trade-based money laundering. Press reports on the consent order indicate the suspect customers described themselves as working in logistics or electronics, and that their transaction patterns did not match legitimate activity for those businesses. Treasury’s release does not describe in detail how the networks operated, and the public documents reviewed for this article do not name individual customers or networks.
A Warning in December 2024
The new penalties did not arrive without notice. On December 23, 2024, the OCC issued a cease-and-desist order citing the bank’s Bank Secrecy Act and sanctions compliance programs. It cited late filing of suspicious activity reports, failure to fix a previously identified weakness in customer due diligence, and deficiencies in internal controls, governance, independent testing and training. The order required an independent consultant, corrective action and lookback reviews.
The OCC’s October 2026 release says the bank did not complete many required steps under that order. More than a year later, according to the agency, it still was not escalating suspicious activity, and it processed potential trade-based money laundering transactions because of a systemic monitoring gap. The OCC concluded that bank management failed to ensure an effective program. The full penalty document is posted as an OCC enforcement action PDF.
The OFAC Findings: Blocked Banks and Delayed Watchlists
OFAC’s release covers conduct from September 18, 2021 through April 24, 2025 and cites 475 apparent violations across programs involving Russia, Belarus, Iran, Burma, Somalia, narcotics trafficking and global terrorism. Of those, 413 were not voluntarily self-disclosed and 62 were. The total transaction value was approximately $14.83 million, and the settlement of $11,662,930 equals the base penalty, with no reduction for remediation or cooperation.
The release identifies several distinct failures:
- Blocked banks in the routing directory. A third-party vendor’s routing directory included blocked banks. The bank processed 403 transactions totaling $14,340,100 between February 2022 and March 2025 through 35 blocked banks, 32 of them blocked under Russia-related sanctions. One of the 35 was blocked under Executive Order 13902, the Iran-related authority.
- Exact-match name flaws. A design flaw classified exact name and date-of-birth matches as low or medium priority. Three sanctioned individuals completed 31 transactions totaling $56,258 between September 2021 and February 2024.
- Watchlist update delays. A vendor error in 2023 led to six transactions totaling $100,828, and a February 2025 system failure led to 26 transactions totaling $146,543 for a ship management company designated under global terrorism sanctions. The bank self-disclosed the latter.
- Blocked accounts left open. One business account stayed open for about 14 months after its beneficial owner was designated.
OFAC classified the violations as non-egregious. Its aggravating factors included reckless conduct, harm to U.S. foreign policy objectives, the bank’s size and sophistication, and prior cautionary letters about substantially similar conduct. OFAC also wrote that “each organization remains responsible for its own compliance regardless of whether it relies upon third-party providers,” a line that bears on the vendor-dependent failures above. The release notes that the bank did not promptly respond to all of the agency’s information requests, and that a January 2025 OFAC administrative subpoena revealed the full scope of the blocked-bank payments.
The Bank’s Response and a Broader Pattern
According to reporting by the Organized Crime and Corruption Reporting Project, Bank of America said it worked with regulators to resolve the matters and is addressing the deficiencies. A spokesperson said: “Financial crime compliance is serious, and we are responsible for getting it right.” The bank said it has invested billions of dollars in technology and assigned thousands of employees to fighting financial crime, and that its remediation work is well advanced.
The case fits a recurring structure in large-bank compliance enforcement. Monitoring systems built for scale generate alert volumes that overwhelm investigators, and vendor data or screening rules introduce gaps that go uncorrected for months or years. The regulators’ findings here, including alerts left uninvestigated, reliance on outside inquiries and an audit function that missed known problems, describe a control environment in which each layer depended on the one before it.
Scale is the other pattern. The OCC’s finding about “trillions of dollars” in transactions with inadequate monitoring reflects the volume of a bank of this size, and the dollar value of confirmed violations in the OFAC action (about $14.8 million) is small relative to that volume. The penalty is large because regulators found the weaknesses persisted despite warnings, not because of the value of any single transaction.
What Remains Unknown
The consent order requires a third-party lookback to identify and report suspicious transactions the bank’s systems missed, along with independent reviews of transaction monitoring, customer due diligence, correspondent due diligence and data governance. Treasury says those reviews will cover the southwest border and cartels, Iran and Russia. The results of that lookback could change the picture: if the review finds additional unreported activity, the $5 billion figure may grow.
Public documents do not identify the customers behind the flagged transactions, name the networks involved, or state how much of the unreported activity was ultimately connected to criminal proceeds. Whether any individuals face scrutiny is not addressed in the releases reviewed. Bank of America’s progress against the 2024 order, and whether the OCC lifts or tightens it, will be the clearest indicator of whether the remediation the bank describes as well advanced holds up to examiner review. Disclosure in the bank’s upcoming quarterly filings may add detail on remediation costs and any further regulatory exposure.
Editor’s note: TIJ reviewed the Treasury, FinCEN, OCC and OFAC releases directly. Bank of America’s statement is drawn from published reporting; TIJ has not obtained additional comment from the bank, and will update this article if it responds.