Key Notes
- FinCEN imposed a $1.2 billion civil penalty on Bank of America, including a credit for the OCC’s $750 million assessment to avoid double-counting.
- Treasury said the bank failed to report more than $5 billion in suspicious transactions on time and must complete independent compliance reviews.
- A separate $11.66 million OFAC settlement covers 475 apparent sanctions violations involving approximately $14.83 million in transactions.
Bank of America Corp. (NYSE: BAC) faces more than $1.21 billion in penalties and settlements after U.S. authorities found extensive failures in its anti-money-laundering and sanctions controls, including delays in reporting more than $5 billion of suspicious transactions.
The Treasury Department announced the actions on October 13. FinCEN imposed a $1.2 billion civil penalty, while the Office of the Comptroller of the Currency assessed $750 million that is credited against that amount. A separate sanctions settlement adds approximately $11.66 million.
The case reaches beyond the immediate financial cost. Bank of America must review historical transactions and submit key compliance systems to independent scrutiny, after regulators said longstanding weaknesses continued even following an earlier enforcement order.
The Penalties Total About $1.21 Billion
The Financial Crimes Enforcement Network’s consent order specifies how the payments fit together. FinCEN agreed to credit the $750 million payment to the OCC against its own $1.2 billion assessment, leaving a further $450 million payable to Treasury under the order.
Adding those two assessments as separate amounts would overstate the combined anti-money-laundering penalty. The Office of Foreign Assets Control settlement is additional: its enforcement release sets the payment at $11,662,930.
Treasury described the FinCEN penalty as the third-largest in its history and the OCC assessment as that agency’s largest. These are civil enforcement actions; the FinCEN order records the bank’s admission to the facts and violations, rather than announcing a criminal guilty plea.
More Than $5 Billion Went Unreported on Time
Bank of America admitted that it willfully violated the Bank Secrecy Act by failing to maintain an adequate anti-money-laundering program, conduct required due diligence on foreign correspondent accounts and file suspicious activity reports, according to Treasury.
The department said the bank failed to report more than $5 billion of suspicious transactions in a timely manner. More than $1 billion involved national-security-related or other priority risks, including activity indicative of Chinese money-laundering networks, fraud and potential trade-based money laundering linked to the southwest border.
Those amounts describe suspicious activity that should have been identified and reported. They are not a finding that the bank earned $5 billion from wrongdoing or that every transaction was proven to involve criminal proceeds.
Treasury said the bank relied too heavily on law-enforcement inquiries and referrals from other institutions to identify potentially suspicious activity. Its own monitoring controls allowed activity to accumulate without investigation, producing late reports that were less useful to investigators.
Regulators Found Failures After an Earlier Order
The OCC’s findings point to problems extending across technology, staffing and oversight. Treasury said the bank’s transaction-monitoring system failed to properly monitor trillions of dollars in transactions and that management had known for years about failures to escalate potentially suspicious activity for investigation.
Key compliance personnel lacked sufficient expertise and training, while internal audit failed to identify longstanding concerns that examiners subsequently uncovered, according to the department.
Bank of America was already subject to a December 2024 cease-and-desist order requiring improvements to its Bank Secrecy Act compliance program. Treasury said significant breakdowns persisted more than a year later, including failures to send suspicious activity to investigators and a systemic monitoring gap involving potential trade-based money laundering.
The current resolution therefore addresses more than an isolated software error. Regulators found that internal warnings, testing and an existing order had not produced an effective compliance program.
Sanctions Settlement Covers 475 Apparent Violations
The separate OFAC case covers 475 apparent sanctions violations between September 2021 and April 2025, involving approximately $14.83 million in transactions. The affected programs target Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism.
OFAC identified payments routed through blocked banks, poorly prioritized alerts involving designated customers, delayed watchlist updates and human errors in handling business accounts associated with blocked persons.
The agency classified the case as non-egregious but said most apparent violations were not voluntarily self-disclosed. It applied no net reduction to the base penalty, including no mitigation for remedial measures or cooperation.
Bank of America also made commitments concerning training, testing, audit and future cooperation with OFAC. Those obligations are separate from the historical-transaction reviews required by FinCEN.
Independent Reviews Will Extend the Compliance Work
FinCEN’s order requires a third-party lookback to identify suspicious transactions missed because of the documented failures and report them to the agency. Independent reviews will assess transaction monitoring, customer due diligence, foreign correspondent-account controls and the data supporting the anti-money-laundering program.
The bank’s brokerage subsidiary also faced a separate reporting case earlier this year. In June, the SEC announced a $7.5 million settlement with Merrill Lynch over failures to file suspicious activity reports. Merrill accepted that order without admitting its findings; it is distinct from the admissions in today’s FinCEN resolution.
Transaction-monitoring failures have also drawn penalties elsewhere in finance, including Coinbase Europe’s Irish enforcement case, as we reported. Those proceedings concern different firms and regulators, but illustrate why functioning monitoring systems matter alongside written compliance policies.
For BAC investors, the confirmed monetary penalty is one part of the outcome. The continuing task is demonstrating that the bank can identify risks promptly, complete the required reviews and sustain effective controls after paying the settlements.
