Banking and Finance Law Daily Wrap Up, BANK SECRECY ACT—Bank of America sanctions penalties top $1.21 billion, (Oct 14, 2026)
Organizations Mentioned:Bank of America Corporation | Bank of America, N.A.
FinCEN credited a separate OCC civil money penalty of $750 against its $1.2 billion assessment.
The Treasury Department announced coordinated enforcement actions imposing more than $1.21 billion in penalties against Bank of America in Bank Secrecy Act (BSA), anti-money laundering (AML), and sanctions matters. Treasury's Financial Crimes Enforcement Network (FinCEN) imposed a $1.2 billion civil money penalty but credited the bank’s $750 million OCC payment, leaving $450 million payable to Treasury. Treasury's Office of Foreign Assets Control (OFAC) separately reached an $11,663,000 settlement covering potential civil liability for 475 apparent sanctions violations. Bank of America admitted the willful BSA violations resolved by FinCEN, while it neither admitted nor denied the OCC findings supporting the agency’s final, effective October 13, 2026, order.
BSA/AML failures. FinCEN’s $1.2 billion assessment incorporates rather than supplements the $750 million OCC payment. Under Consent Order No. 2026-03, FinCEN agreed to credit the full OCC payment, leaving $450 million payable to Treasury. The separate $11,662,930 OFAC settlement brings Treasury’s announced total to more than $1.21 billion. The OCC order, AA-ENF-2026-41, requires its $750 million payment upon execution.
In the FinCEN resolution, the bank admitted that it willfully failed to maintain a compliant AML program, conduct required due diligence for U.S. correspondent accounts of foreign financial institutions, and file accurate and timely suspicious activity reports (SARs). FinCEN tied the conduct to violations of 31 U.S.C. §§ 5318(h)(1), 5318(i), and 5318(g), and 31 C.F.R. §§ 1020.210(a), 1010.610, and 1020.320.
FinCEN determined, and the bank admitted for the resolution, that the reporting failures involved more than $5 billion in suspicious transactions. More than $1 billion implicated national-security-related and other priority illicit-finance risks, including Chinese money laundering networks, fraud, and potential trade-based money laundering with a substantial nexus to the southwest border. Those amounts describe transactions affected by the reporting failures, not established criminal proceeds.
The OCC’s separate order became final and effective on October 13, 2026, and requires the bank to pay $750 million upon execution. The Comptroller found violations of 12 C.F.R. §§ 21.21 and 21.11, foreign correspondent due-diligence requirements in 31 C.F.R. § 1010.610, and the Travel Rule at 31 C.F.R. § 1010.410(f); Bank of America neither admitted nor denied those findings. The OCC called the assessment the largest penalty in its history. Comptroller of the Currency Jonathan V. Gould said, “The bank’s poor response to its BSA deficiencies is unacceptable.”
Required remediation. The required third-party SAR lookback covers customer activity from January 2022 until the bank completes remediation of its suspicious-activity-monitoring deficiencies. It includes credit-card activity, negotiable instruments, cross-border and other transactions tied to high-risk jurisdictions, and Event Groups that were not investigated because they scored between 10 or 12 points, as applicable, and the former 20-point threshold. The consultant must consider targeted expansion to Event Groups scoring between 6 and 10 points.
The consultant must use a risk-based approach that prioritizes transactions potentially tied to the U.S. southwest border, cartels and possible narcotics trafficking, Chinese money laundering networks, Iran, and Russia. FinCEN also requires independent reviews of the effectiveness of the bank’s suspicious-activity monitoring, customer due diligence, foreign correspondent-account due diligence, and the data-governance framework supporting its AML program. Those undertakings are additional to and independent of obligations under related resolutions.
Previously, the OCC issued a cease-and-desist order against Bank of America on December 23, 2024, over deficiencies in its BSA and sanctions compliance programs. That order required corrective actions, an independent assessment, and lookback reviews (see Banking and Finance Law Daily, Jan. 3, 2025).
Sanctions settlement. The OFAC settlement resolves potential civil liability for 475 apparent violations of sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. OFAC said the apparent violations occurred from September 18, 2021, through April 24, 2025, and involved transactions worth approximately $14,834,082. It attributed the conduct to payments involving blocked banks, inadequate prioritization of exact name-and-date-of-birth matches to blocked persons, delayed watchlist updates, and human error affecting two business accounts associated with blocked persons.
OFAC determined that 413 apparent violations were not voluntarily self-disclosed and 62 were voluntarily self-disclosed. It treated the matter as non-egregious and set the $11,662,930 settlement equal to the base civil monetary penalty, with no reduction for remedial measures or cooperation.
Companies: Bank of America, N.A.; Bank of America Corporation
MainStory: TopStory BankSecrecyAct EnforcementActions GCNNews NorthCarolinaNews