Bank of America has been ordered to pay more than $1.21 billion in penalties over failures to meet US anti-money-laundering and sanctions requirements, in an enforcement action that the Treasury Department described as the third-largest penalty in its history and the largest ever imposed by the Office of the Comptroller of the Currency (OCC). Announced on 13 October 2026, the measures target shortcomings in the bank’s detection and reporting of suspicious financial activity, customer due diligence and compliance with sanctions programmes.
The Financial Crimes Enforcement Network (FinCEN) imposed a $1.2 billion penalty after finding that the bank had failed to identify and report more than $5 billion in suspicious transactions in a timely manner. More than $1 billion of that activity involved national security-related and other priority risks, including transactions indicative of Chinese money-laundering networks, fraud and potential trade-based money laundering connected to the US south-western border. The Treasury Department said the failures included activity that could pose risks to national security.
The OCC separately imposed a $750 million civil money penalty over what it described as a deficient and ineffective anti-money-laundering compliance programme. The Treasury Department also announced an $11.6 million settlement with the bank over 475 apparent violations of multiple sanctions programmes. The settlement covered transactions associated with Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism. Together, the three measures exceed $1.21 billion, although the individual amounts relate to separate enforcement actions.
Bank of America admitted in its resolution with FinCEN that it had wilfully violated the Bank Secrecy Act. The agency said the bank failed to maintain an anti-money-laundering programme meeting minimum legal requirements, conduct adequate due diligence on correspondent accounts held for foreign financial institutions, and submit suspicious activity reports when required. Investigators identified weaknesses in transaction monitoring and customer due diligence, including failures to respond appropriately to warning signs involving customers who relied extensively on payments from unknown third parties.
According to the Treasury Department, the bank prioritised revenue and minimised the resources allocated to compliance as problems emerged. Rather than relying on effective internal controls to identify suspicious transactions, it became substantially dependent on law enforcement inquiries, referrals from other financial institutions and similar external interventions. Suspicious activity accumulated without investigation for extended periods, leading to delayed reports that the authorities considered of limited usefulness to law enforcement.
The department said the bank failed to take meaningful corrective action even after testing exposed significant weaknesses. Compliance staff escalated concerns involving possible trade-based money laundering and fraud, including potential links to narcotics proceeds, but the bank did not respond adequately or promptly. Its customer due diligence processes also failed to account properly for customers’ extensive dependence on payments from unidentified third parties.
The OCC found that the deficiencies extended across transactions worth trillions of dollars, which the bank’s monitoring system had failed to scrutinise adequately. This resulted in large numbers of late suspicious activity reports involving billions of dollars, many containing indications of money laundering. The regulator said the bank had known for years that potentially suspicious activity was not being escalated to investigators for assessment, yet had failed to correct the problem.
The OCC also identified shortcomings in staffing, training and internal auditing. The bank’s anti-money-laundering officer and other personnel lacked sufficient expertise to manage the programme effectively, while key staff had not received appropriate training in identifying, investigating and reporting suspicious activity. The internal audit function failed to detect longstanding problems that regulators subsequently uncovered.
The bank had already been subject to a cease-and-desist order issued in December 2024 requiring improvements to its anti-money-laundering programme. According to the OCC, significant corrective steps remained incomplete more than a year later, and the programme continued to suffer serious failures. These included the failure to refer potentially suspicious transactions for investigation and systemic gaps in monitoring that allowed potential trade-based money laundering transactions to be processed.
The sanctions settlement concerned a separate set of compliance failures. According to the Office of Foreign Assets Control (OFAC), the bank processed payments through blocked banks because of technical and human errors, allowed designated individuals to make payments and withdraw funds because of poorly calibrated sanctions alerts, and failed to update watchlists promptly after new designations. It also mishandled business accounts associated with blocked persons. These failures resulted in millions of dollars in payments that apparently violated sanctions requirements.
OFAC characterised the violations as non-egregious and said most had not been voluntarily disclosed by the bank. The $11.6 million settlement included no reduction to the base penalty for remedial measures or cooperation. As part of the agreement, Bank of America committed to measures covering compliance training, testing, auditing and future communication and cooperation with OFAC.
Treasury Secretary Scott Bessent said the failures had consequences beyond the bank itself. “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire US financial system to significant illicit finance risks,” he said. He added that the enforcement actions sent a message that even the largest financial institutions were not above the law.
Bank of America told Bloomberg that it had already invested billions of dollars in technology to combat financial crime and was working to address the problems identified by regulators. The bank also said its third-quarter results, due to be released on Wednesday, would include a non-tax-deductible charge of $1.2 billion, reducing quarterly earnings by approximately 17 cents per share.
The enforcement action followed a $350 million fine imposed the previous week on American Express National Bank, the direct-banking subsidiary of the credit card company American Express, over similar deficiencies in anti-money-laundering controls.
