US authorities announced more than $1.21 billion in penalties against Bank of America on 13 October over anti-money-laundering and sanctions compliance failures. The Treasury enforcement package combines action by financial-crime investigators, the bank’s federal supervisor and the sanctions authority, alongside requirements to examine missed transactions and repair controls.
The headline penalties cannot simply be added together. FinCEN’s $1.2 billion assessment credits the Office of the Comptroller of the Currency’s $750 million penalty. The OCC’s announcement explicitly confirms that credit. The separate OFAC settlement is additional, rather than another overlapping part of the FinCEN assessment.
Missed reporting leads to a new transaction review
In the FinCEN consent order, the bank admits the stated facts and civil Bank Secrecy Act violations for the purpose of resolving that matter. FinCEN says more than $5 billion in suspicious activity was not reported accurately and on time, including over $1 billion linked to priority illicit-finance risks. Suspicion in a reporting case is not proof that every underlying transaction was criminal.
The order requires an independent consultant to review covered customer activity from January 2022 through completion of relevant monitoring repairs. The bank must propose the consultant within 60 days of execution. The review covers specified credit-card activity and cross-border transactions, as well as other identified gaps in the monitoring system.
The detailed review report is due within 18 months of its scope report and no later than December 2028. The bank then has up to 90 days to complete the required suspicious-activity filings identified by the consultant. The financial settlement therefore leaves a multi-year reporting exercise to complete.
The OCC says earlier repairs were insufficient
The OCC’s penalty order records findings that the bank neither admits nor denies. It says management received written reports between 2019 and 2023 showing missed reports on potentially suspicious activity. A backlog awaiting investigator review reached nearly 200,000 cases in 2024, according to the order.
The OCC also identified incorrect sender information in about 33,300 outgoing wires, totalling approximately $1 billion, between November 2021 and October 2024. It says monitoring weaknesses persisted after its earlier order. These are the regulator’s findings about the bank’s controls and reporting, rather than criminal judgments against the customers involved.
The 2024 consent order shows what the bank had already been required to fix. It demanded a board-level compliance committee and a written action plan, with named responsibility and timelines for corrective work. The committee had to review implementation at least quarterly, while progress reports went through the board to the OCC.
That earlier order also required independent assessment of the anti-money-laundering and sanctions programmes. Its transaction-monitoring provisions covered the accuracy of data inputs, testing of alert thresholds and manual procedures for activity outside automated systems. The continuing obligations extend beyond buying screening software: they include checking whether the systems capture the intended accounts and transactions and whether staff investigate the resulting alerts.
Sanctions alerts and payment routing
The separate OFAC enforcement release sets the settlement at $11,662,930 for 475 apparent sanctions violations involving roughly $14.83 million in transactions. The conduct ran from September 2021 to April 2025. OFAC classed the case as non-egregious, but said most apparent violations were not voluntarily disclosed.
One failure concerned correspondent-bank routing. OFAC says 403 payments totalling about $14.34 million passed through 35 blocked banks. Problems included delayed screening updates and human errors in reviewing alerts. Some alerts were also suppressed because similar matches had previously been treated as false positives.
Other failures involved slow watchlist updates and low-priority treatment of customers whose names and birth dates exactly matched blocked persons. In one episode, OFAC says a vendor error left the sanctions watchlist unchanged from 24 May to 28 June 2023. The bank detected the problem only after another US bank blocked a payment downstream. OFAC says the settlement gives no reduction from the base penalty, including for remediation or cooperation. Its release stresses that using an outside technology provider does not remove an organisation’s own compliance responsibilities.
Related Dalimss News coverage explains India’s crypto identity-check requirements and the US action against North Korean laptop-farm networks. Those concern separate regulatory regimes and enforcement events.
