International

Bank of America Handed $1.2 Billion Multi-Agency Regulatory Penalty Over Systemic AML and Sanctions Lapses

By The Legal Alpha Web Desk · 14 October 2026 · 5 min read
Bank of America Handed $1.2 Billion Multi-Agency Regulatory Penalty Over Systemic AML and Sanctions Lapses

The U.S. Department of the Treasury, through the Financial Crimes Enforcement Network (FinCEN) and the Office of Foreign Assets Control (OFAC), alongside the Office of the Comptroller of the Currency (OCC), has penalized Bank of America, N.A. more than $1.2 billion. The enforcement action follows findings of systemic breakdowns in the bank’s anti-money laundering controls and compliance with international sanctions.

Federal regulators determined that Bank of America failed to maintain adequate suspicious activity monitoring and effectively outsourced core detection tasks by relying on law enforcement inquiries rather than proactive internal controls. Under the coordinated settlement, the bank admitted to willful violations of the Bank Secrecy Act and agreed to substantial civil money penalties and operational remediation.

Legal Topic

  • Area of Law: Banking & Financial Services Regulatory Law

  • Sub-topic: Anti-Money Laundering (AML) / Sanctions Enforcement / Bank Secrecy Act Compliance

Core Legal Issue

The fundamental legal question centered on whether a major financial institution satisfies its affirmative surveillance and risk-mitigation statutory duties under the Bank Secrecy Act when its detection mechanism relies on retrospective external queries rather than independent transaction monitoring.

Regulators examined whether Bank of America’s internal architecture constituted a legally sufficient, risk-based AML compliance program, or whether delegating proactive detection to external law enforcement notices amounted to an impermissible abdication of mandatory reporting duties and foreign correspondent due diligence requirements.

What Did the Authority Decide?

Federal authorities finalized comprehensive enforcement actions and consent orders mandating both monetary liability and compliance reform:

  • Civil Monetary Penalties: The Treasury and companion regulators assessed penalties totaling over $1.2 billion, with FinCEN levying a primary $1.2 billion penalty coordinated alongside a record $750 million assessment by the OCC and an OFAC settlement addressing hundreds of sanctions violations.

  • Admissions of Violation: Bank of America admitted on record that it willfully violated the Bank Secrecy Act by failing to implement an adequate AML program, failing to conduct required customer due diligence on correspondent accounts, and failing to file timely Suspicious Activity Reports (SARs).

  • Compliance Mandates: The bank must overhaul its surveillance workflows, eliminate reliance on reactive law enforcement triggers, remediate legacy transaction records, and undergo rigorous supervisory reviews to ensure regulatory parity.

Key Legal Points

  • Prohibition Against Outsourcing Proactive Duties: Financial institutions cannot treat outside inquiries, subpoenas, or law enforcement notices as substitutes for an internal monitoring program.

  • Statutory Due Diligence on Correspondent Banking: Heightened regulatory diligence is non-negotiable for foreign correspondent accounts, which present inherent vulnerabilities for illicit cross-border transfers.

  • Sanctions Strict Liability and Tracking: Apparent breaches across designated sanctions regimes (including counter-terrorism, narcotics, and state-specific programs) trigger severe statutory exposure under OFAC administration.

  • Standard for "Willful" Non-Compliance: The regulatory finding of willful violation underscores that chronic, known deficiencies in transaction monitoring satisfy the legal threshold for gross disregard of statutory mandates.

Relevant Law

  • Bank Secrecy Act (BSA), 31 U.S.C. § 5311 et seq.

  • FinCEN Regulations on AML Programs and SAR Reporting, 31 C.F.R. Chapter X

  • International Emergency Economic Powers Act (IEEPA), 50 U.S.C. § 1701 et seq. (governing OFAC sanctions regimes)

  • National Bank Act & OCC Enforcement Authorities, 12 U.S.C. § 1818

Arguments of the Parties

U.S. Treasury and Banking Regulators

Regulators contended that Bank of America operated deficient monitoring systems that systematically failed to flag high-risk transactions across critical corridors. FinCEN and the OCC argued that by depending on external third parties and investigative agencies to alert the bank to illicit flows, the institution effectively outsourced its statutory reporting obligations and breached mandatory due diligence rules.

Bank of America

The bank entered into consent agreements acknowledging non-compliance and willful violations of the Bank Secrecy Act. While resolving the actions through substantial monetary payouts, the institution committed to sweeping governance overhauls and investments into automated transaction monitoring, emphasizing ongoing efforts to align operations fully with federal compliance standards.

Why Does It Matter?

This multi-agency enforcement action sends an unmistakable signal to the global banking sector: regulatory compliance cannot be treated as a reactive back-office function. By explicitly penalizing an institution for leaning on law enforcement tips rather than its own proprietary alert systems, regulators have established that passive detection constitutes a per se failure of affirmative compliance.

For domestic and international financial institutions, the scale of this penalty underscores that correspondent banking channels require continuous, aggressive vetting. The action elevates board-level accountability and signals that supervisory authorities will pursue historic fines where compliance infrastructure fails to match institutional scale.

Legal Takeaway

Regulated financial entities have a strict, affirmative statutory duty to independently identify and report suspicious activities rather than relying on external inquiries or law enforcement prompts. Passive AML infrastructure amounts to legal non-compliance, leaving institutions exposed to major civil penalties and findings of willful violation.

Sources

Primary Source:

  • U.S. Department of the Treasury, Financial Crimes Enforcement Network (FinCEN) Enforcement Release & Consent Order: In the Matter of Bank of America, N.A. (October 13, 2026).

  • U.S. Office of the Comptroller of the Currency (OCC) Consent Order for Civil Money Penalty against Bank of America, N.A. (October 2026).

Additional Sources:

  • U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC) Settlement Notice.

Related reporting