Publication date: 15 October 2026
US authorities have imposed more than $1.21 billion in penalties on Bank of America for anti-money-laundering and sanctions failures, one of the largest enforcement actions in Treasury history. The scale is striking, but the more important lesson is operational: a global bank’s ability to understand customers, monitor transactions and escalate warnings is part of its essential financial infrastructure.
What regulators found
The Treasury Department announced coordinated actions involving the Financial Crimes Enforcement Network, the Office of the Comptroller of the Currency and the Office of Foreign Assets Control. FinCEN assessed a $1.2 billion penalty, the OCC assessed $750 million and OFAC announced an $11.6 million settlement. Credits and coordination between agencies mean the announced aggregate cost is more than $1.21 billion rather than the simple sum of every assessment.
As part of the FinCEN resolution, Bank of America admitted willfully violating the Bank Secrecy Act. Regulators said it failed to maintain an adequate anti-money-laundering programme, perform required due diligence on foreign correspondent accounts and file suspicious activity reports on time.
Treasury said more than $5 billion of suspicious transactions were not reported promptly, including over $1 billion connected to priority illicit-finance risks. It identified indicators involving Chinese money-laundering networks, fraud and possible trade-based laundering linked to the US southwest border.
A failure of systems and incentives
The action is not simply about individual missed alerts. Treasury said suspicious activity accumulated without investigation and that the bank relied too heavily on law-enforcement inquiries and warnings from other institutions instead of its own proactive controls. It also said earlier testing had exposed problems that were not addressed meaningfully.
That description points to a familiar governance failure. Transaction-monitoring systems generate large volumes of alerts, but technology is useful only if the data are accurate, the rules reflect current risks and investigators have enough time and authority to act. Under-resourced teams can turn sophisticated monitoring into a queue of unresolved warnings.
Revenue incentives matter as well. Compliance functions must be able to challenge profitable customers and correspondent relationships without being overridden by short-term commercial priorities. When that independence is weak, the risk migrates from individual transactions to the institution’s entire control environment.
The financial consequences extend beyond the fine
Bank of America also reported a $1.2 billion charge connected with the regulatory settlement as third-quarter profit fell. The bank is now required to conduct a third-party lookback for undetected suspicious transactions and undergo independent reviews of monitoring, customer due diligence, correspondent banking and related data governance.
Those obligations can be more consequential than a one-off penalty. Remediation requires new staff, redesigned systems, external oversight and management attention over several years. It may also constrain product launches or customer growth while controls are rebuilt.
A lesson for every data-intensive institution
Large banks increasingly use machine learning to prioritise alerts and identify networks of suspicious behaviour. Regulators will still judge outcomes, not the sophistication of the software. Firms must be able to explain how models work, trace decisions to reliable data and demonstrate that high-risk cases receive human review.
The enforcement action shows that compliance data should be governed with the same seriousness as credit and liquidity data. A failure to detect illicit finance is not a peripheral technology problem. It can become a capital, earnings, reputational and national-security issue at the same time.