Bank of America Fined $1.21bn for AML Violations

The US Department of the Treasury has announced coordinated enforcement actions imposing more than $1.21 billion in penalties against Bank of America for anti-money laundering (AML) and sanctions violations, including the largest penalty ever issued by the Office of the Comptroller of the Currency (OCC).

“Financial institutions are on the front lines of protecting our economic and national security,” said Treasury Secretary Scott Bessent. “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks. Today’s actions send a clear message that even the biggest financial institutions are not above the law.”

The Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN) assessed a $1.2 billion penalty after Bank of America admitted to willfully violating the Bank Secrecy Act. FinCEN said the bank failed to report more than $5 billion in suspicious transactions, including more than $1 billion involving priority illicit-finance and national-security risks, in a timely manner. Its investigation identified weaknesses in transaction monitoring, customer due diligence, and foreign correspondent account controls. FinCEN also found that the bank relied heavily on law enforcement inquiries and referrals from other financial institutions to identify suspicious activity that its own controls should have detected.

The OCC assessed a $750 million penalty for what it described as a “deficient and ineffective” BSA/AML compliance program. That amount will be credited toward FinCEN’s $1.2 billion penalty. The OCC found that Bank of America had known for years that potentially suspicious activity was not being escalated appropriately, while key compliance personnel lacked sufficient expertise and training, and the internal audit function failed to identify longstanding problems later uncovered by examiners. The regulator also said significant weaknesses remained after a December 2024 cease-and-desist order required remediation.

The Office of Foreign Assets Control (OFAC) reached an $11.6 million settlement covering 475 apparent sanctions violations across several programs. OFAC said the apparent violations stemmed from weaknesses in sanctions screening, alert calibration, watchlist updates, and the handling of accounts linked to blocked persons. OFAC characterized the apparent violations as non-egregious and largely not voluntarily self-disclosed.

Bank of America must now conduct a third-party lookback for previously undetected suspicious transactions and undergo independent reviews of its transaction monitoring, customer due diligence, foreign correspondent account controls, and related data governance. Treasury said the actions underscore the need for institutions to effectively integrate AML and sanctions controls and to respond promptly when internal testing or other warning signs reveal weaknesses.