FinCEN, OCC, and OFAC Assess Record BSA/AML Penalties Against Bank of America
On October 13, 2026, U.S. regulators imposed coordinated enforcement actions against Bank of America totaling $1.2 billion for willful Bank Secrecy Act violations, reckless sanctions failures, and deficient transaction monitoring, driven in part by a flawed automated correspondent-banking routing system.
A. Executive Summary
On October 13, 2026, U.S. regulators levied historic, coordinated enforcement actions against Bank of America. The penalties include a $1.2 billion FinCEN consent order (which credits a $750 million OCC penalty, described by the OCC as the largest in its history) and an $11.66 million OFAC settlement. The bank admitted to willful Bank Secrecy Act (BSA) violations spanning from 2018 to 2025, while OFAC characterized the bank’s sanctions conduct as reckless. The sweeping enforcement actions stem from billions of dollars in delayed Suspicious Activity Reports (SARs), the outsourcing of core detection obligations, and a flawed automated correspondent-banking routing system that processed payments for blocked Russian, Belarusian, and Iranian banks. For Chief Anti-Money Laundering Officers (CAMLOs) and banking legal counsel, these penalties underscore the substantially escalated consequences of failing to remediate known transaction monitoring deficiencies and over-relying on vendors for priority illicit-finance risk detection.
Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.
B. What Happened
On October 13, 2026, the Financial Crimes Enforcement Network (FinCEN), the Office of the Comptroller of the Currency (OCC), and the Office of Foreign Assets Control (OFAC) issued a coordinated enforcement package against Bank of America.
- FinCEN Consent Order: FinCEN assessed a $1.2 billion penalty after the bank admitted to willful violations of the BSA. The agency cited exposure to Chinese money laundering networks and southwest border flows, noting that more than $5 billion in suspicious activity was reported late. FinCEN specifically found that Bank of America effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations. Because the $1.2 billion FinCEN order credits the $750 million OCC penalty, the bank will pay FinCEN $450 million directly, resulting in a combined $1.2 billion payout rather than $1.95 billion.
- OCC Enforcement Action: The OCC issued a $750 million civil money penalty, its largest ever, citing a deficient transaction monitoring system. The OCC found that the bank’s BSA Officer and staff lacked sufficient skills and expertise, that the bank’s own BSA audit function failed to catch longstanding compliance concerns that examiners later uncovered, and that the bank processed potential trade-based money laundering transactions due to a systemic transaction-monitoring gap. Crucially, these failures continued even after a December 2024 cease and desist order, which remains in place.
- OFAC Settlement: OFAC settled 475 apparent violations across seven sanctions programs (Russia, Belarus, Iran, Burma, Somalia, narcotics trafficking, and global terrorism). OFAC characterized the conduct as “reckless,” a generally lower culpability standard than FinCEN’s “willful” designation. While 32 violations involved watchlist delays across two separate incidents in 2023 and 2025, and 31 involved name and date-of-birth matching issues, the vast majority of the conduct (403 violations representing $14.34 million of the roughly $14.83 million total apparent violation value) resulted from Bank of America processing payments through blocked Russian, Belarusian, and Iranian banks via a flawed automated correspondent-banking routing system. The bank knew its routing directory contained blocked banks as early as March 2022 and told OFAC it was investigating, but did not identify the full scope of the problem until OFAC issued an administrative subpoena in January 2025. OFAC specifically noted this failure ran directly counter to the objectives of the Russia sanctions program following the invasion of Ukraine.
Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.
C. Why It Matters for Legal & Compliance
This penalty package demonstrates the substantially escalated liability that accrues when compliance programs fail to scale with risk or remediate past regulatory findings. Three points stand out:
1. Automated routing directories require rigorous sanctions screening validation.
The OFAC settlement highlights that the largest source of violations was a flawed automated correspondent-banking routing system that maintained blocked Russian, Belarusian, and Iranian banks. The bank’s failure to identify the full scope of this issue for nearly three years, despite prior knowledge, was a major driver of the penalty.
In practice: automated payment routing systems that operate outside of, or in parallel to, standard sanctions screening filters are significant vulnerabilities. If a routing directory is not dynamically updated and cross-referenced against OFAC lists, an institution risks processing hundreds of prohibited transactions before a subpoena forces a full manual review.
2. Over-reliance on third-party vendor detection creates serious regulatory gaps.
FinCEN specifically targeted the bank’s practice of effectively outsourcing a substantial portion of its proactive detection and reporting obligations to third parties.
In practice: while banks regularly use vendor software for transaction monitoring, the legal obligation to proactively detect and report illicit activity cannot be outsourced. If vendor-managed filters fail to flag priority risks like Chinese money laundering networks, the bank remains fully liable for the resulting delayed SARs.
3. “Recidivist” failures and internal audit blind spots signal deep structural flaws.
The OCC’s action specifically notes that monitoring failures persisted after the issuance of a December 2024 cease and desist order, and that the bank’s internal BSA audit function failed to identify these longstanding issues before examiners found them. Regulators show diminishing patience for uncorrected remediation promises.
In practice: a compliance department cannot rely on passing its own internal audits if the audit methodology itself is flawed or lacks the technical expertise to evaluate the bank’s dominant transaction pipelines. Failing to operationalize fixes from prior enforcement actions directly leads to escalated fines.
D. Action Items for Organizations
- Validate Automated Routing Systems: Evaluate correspondent-banking routing directories to ensure they are fully integrated with OFAC watchlist updates and cannot autonomously route payments to blocked banks.
- Assess Vendor Reliance: Review transaction monitoring and SAR generation workflows to ensure the bank maintains proactive, internal oversight over its detection obligations rather than over-relying on third-party vendors.
- Audit Internal Remediation and Audit Functions: Confirm that any previously identified AML/BSA or sanctions control gaps are fully operationalized, and evaluate whether the internal BSA audit team possesses the requisite skills to test those fixes.
- Test Transaction Monitoring for TBML: Review transaction monitoring systems to verify that pipelines are adequately tuned to detect potential trade-based money laundering (TBML) and priority illicit-finance risks.
Want weekly regulatory updates delivered straight to your inbox? Subscribe to the Reg Compliance Hub here.
Disclaimer: This article does not constitute legal advice. Readers should seek legal or tax advice from their professional advisers regarding their specific regulatory and legal obligations.
