The Bank of America AML penalty: $1.2 billion for a monitoring system that waited for subpoenas

The Bank of America AML penalty is a $1.2 billion FinCEN civil money penalty announced on 13 October 2026, crediting a record $750 million OCC penalty. FinCEN found the bank failed to timely report more than $5 billion of suspicious activity from 2018 to 2025. OFAC separately settled 475 apparent sanctions violations for $11,662,930.

• FinCEN Consent Order 2026-03 imposes $1.2 billion; FinCEN credits the OCC's $750 million, so Bank of America pays FinCEN $450 million within ten days.
• Bank of America admits it willfully violated the Bank Secrecy Act, in the civil sense of reckless disregard or willful blindness.
• In several years, more than one-third of the bank's investigations were prompted by law enforcement, other banks or manual referrals rather than its automated monitoring.
• Treasury says the actions include the third-largest penalty in its history and the largest in OCC history.
• A FinCEN-supervised SAR lookback runs from January 2022 and must report no later than December 2028.

What is the Bank of America AML penalty?

The Bank of America AML penalty came from three Treasury bodies acting together on 13 October 2026. FinCEN imposed $1.2 billion for willful failures in its AML program, correspondent due diligence and suspicious activity reporting. The OCC assessed $750 million for the same program failures. OFAC settled sanctions breaches for $11,662,930.

The Treasury announcement puts the combined figure at more than $1.21 billion, because FinCEN credits the OCC payment against its own penalty. Treasury Secretary Scott Bessent said the actions show "even the biggest financial institutions are not above the law".

The conduct in the FinCEN consent order ran from at least 1 January 2018 to 1 July 2025. Treasury says the bank's reliance on outside referrals meant it "effectively outsourced to third parties a substantial portion of its proactive detection". The bank admits the facts; in the separate OCC order AA-ENF-2026-41 it neither admits nor denies the findings.

FinCEN's order rests on three violations: the AML program rule at 31 CFR 1020.210, correspondent due diligence at 31 CFR 1010.610 and SAR filing at 31 CFR 1020.320. The OCC adds the Travel Rule at 31 CFR 1010.410(f): between November 2021 and October 2024 the bank sent about 33,300 outgoing wires, worth about $1 billion, with inaccurate transmittor information.

How did the transaction monitoring fail?

Bank of America's failure sat in one proprietary system, Event Processor, which scored alerts and grouped them by customer before anyone looked. A group only became a case at 20 points within a 13-month window. FinCEN says that threshold was "initially set by stakeholder judgment" and stayed unchanged until December 2023.

Some risk factors counted once per group however often they fired, so a repeated large-wire alert could add only one point. Alerts older than 13 months stopped scoring. FinCEN found investigations sometimes began more than a year after the transactions. A SAR is due within 30 days of initial detection, so detection delayed by a year defeats the rule's purpose.

The bank's own testing showed the threshold was wrong. In 2022 and early 2023, groups scoring 16 to 19 points, just below the line, had a SAR yield of 38% to 45%, above the roughly 33% to 34% that 2018 to 2020 testing found at 20 to 24 points. Until December 2023 there was no predefined tolerance for false negatives.

Because point scores often fell short, "auto-promote" events did much of the work: manual referrals, subpoenas, seizure warrants, law enforcement requests and 314(a) and 314(b) inquiries sent a group straight to investigation. For several years, more than one-third of all the bank's investigations began from these events rather than automated monitoring.

When the bank cut the threshold to 10 or 12 points and the window to four months in December 2023, a one-time review produced more than 8,000 SARs covering about $3.96 billion. The bank estimated the new settings would double monthly investigations and require about 750 extra staff, plus 800 consultants for the review. FinCEN reads that gap as compliance spending the bank had avoided for years.

The OCC adds its own measurements. Between 2019 and 2023, management received reports that the bank was not filing SARs on roughly 18% to 44% of potentially suspicious activity that was never referred for investigation. The investigation backlog peaked at nearly 200,000 cases in 2024. Examiners sampling the $102 billion credit card portfolio found ten accounts showing potential trade-based laundering, and SARs followed on half of them.

Where did customer due diligence break down?

FinCEN found Bank of America's customer risk profiles moved with subpoenas rather than with the bank's own analysis. For one customer, its "Dynamic Risk Rating" swung between standard, elevated and high in step with subpoenas and law enforcement inquiries. It also missed one customer's public securities filing disclosing a Department of Justice money laundering investigation.

The clearest examples are two online salvage-vehicle auction customers, unnamed in the order as Customers A and B. Between October 2020 and May 2025 they received more than 680,000 negotiable instrument deposits, largely money orders, in about 220,000 suspicious groups worth over $660 million. Compliance staff recommended offboarding Customer A, and the bank did not accept that recommendation during the period. Event Processor had minimal coverage of negotiable instruments, and quarterly reviews of these high-risk customers left that activity out entirely.

Another customer was onboarded as a small to medium business expecting $1 million to $4 million of annual sales. It then received wires from high-risk jurisdictions orders of magnitude above that profile. More broadly, FinCEN found the bank retained high-risk and high-value customers despite contrary recommendations from compliance.

Correspondent banking showed the same pattern. Until late 2024 the bank applied "simplified" due diligence to accounts it held for its own foreign branches and affiliates. FinCEN reviewed twelve of them and found they served more than 250 non-bank financial institutions, including money services businesses, without files describing the expected activity.

What does this change for your obligations?

The orders behind the Bank of America AML penalty turn several general BSA duties into specific tests that examiners can now cite. Each one maps to a regulation, and each failure in this case came from a design decision the bank could not evidence. Firms should read the findings duty by duty and check their own program against each.

For suspicious activity reporting under 31 CFR 1020.320, the 30-day clock runs from initial detection. Firms need documented, tested reasons for every threshold, window and suppression rule, plus a defined tolerance for false negatives. Bank of America's remediation set 5% for management and 7.5% for Board escalation, later tightened for priority typologies.

For the AML program's internal controls under 31 CFR 1020.210, the case sets a measurable warning sign. If a large share of your suspicious activity reports start from subpoenas, other banks or manual referrals, your transaction monitoring is not doing the detecting. Track the ratio of internal to external case triggers and report it to the board.

For ongoing customer due diligence, the expected-activity profile captured at onboarding must stay live. Ratings should move on your own data, such as product use, third-party payments and geography, not only on outside inquiries. Periodic reviews must cover every product a high-risk customer uses, including money orders and cheques.

For correspondent accounts under 31 CFR 1010.610, affiliate status does not excuse missing information. Each account file needs its purpose, anticipated activity and the supervisory regime, and that holds for your own branches too.

For sanctions screening, OFAC found the bank's system ranked customers whose name and date of birth both exactly matched a blocked person as low or medium priority. Three designated individuals made 31 transactions worth $56,258 before the fix in February 2024. Exact identity matches belong at the top of the queue. Watchlist latency mattered too: a vendor error in May and June 2023 let six payments worth $100,828 through, and a failed update on 7 February 2025 let through 26 payments worth $146,543 on behalf of a designated ship management company. Alert suppression rules also need review, because one released payments through blocked banks.

What is still uncertain?

The Bank of America case is settled, but the size of the reporting gap is not. The lookback covers activity from January 2022 until remediation ends, and FinCEN can widen it. Its final report is due no later than December 2028, so the volume of late SARs still to come is unknown.

Remediation risk is real. The OCC says that more than a year after its December 2024 cease-and-desist order, the bank still was not escalating potentially suspicious activity to investigators. The end-state effectiveness review of the new monitoring must start no later than October 2027, and the OCC reserves the right to impose further penalties if violations continue.

Liability is not closed either. FinCEN's release covers only its own claims for the described conduct. The order does not bind the Department of Justice or other agencies, and it leaves individual officers and employees outside its protection.

FinCEN's lookback undertaking lets the consultant use "super intelligence models" and graph analytics, which signals FinCEN expects advanced analytics in historical reviews. The same order criticises thresholds that lacked "empirical support". Model-driven monitoring therefore needs the same documented calibration evidence that Event Processor lacked.

How does this compare with earlier AML penalties?

The Bank of America AML penalty sits just below the TD Bank case in FinCEN terms but sets a new record for the OCC. FinCEN's $1.3 billion penalty against TD Bank in October 2024 remains, by FinCEN's description, the largest against a depository institution. The OCC says its $750 million is the largest in its history.

Sources for the table: the TD Bank FinCEN release, the OCC's TD Bank release, the OCC release on Bank of America and our earlier reports on the American Express AML penalty and the UBS penalty.

How should compliance teams respond?

Start with the evidence an examiner would ask for after reading the FinCEN order against Bank of America. Pull the calibration file for every monitoring threshold, alert window and suppression rule, and confirm each has data behind it. If the file says "stakeholder judgment", treat it as an open finding.

Then measure what share of last year's investigations began from subpoenas, 314(a) or 314(b) requests and referrals from other banks. Compare high-risk customers' actual flows against their onboarding profile, by product and by jurisdiction. Check that exact name and date-of-birth matches to sanctioned persons are your highest-priority alerts, and that watchlist updates reach screening the same day. Review correspondent files for your own affiliates with the same rigour as third-party banks.

Zyphe gives compliance teams verified identity data and an exportable audit trail to evidence the customer side of these checks, with no central store of customer PII. See our AML software and sanctions screening software, or book a demo.

The bottom line

The Bank of America AML penalty is a case about who does the detecting. A monitoring system tuned on judgment rather than data let alerts age until subpoenas and other banks did the detecting. Regulators now expect firms to prove their thresholds, measure how much detection is their own, and keep customer profiles moving with real activity. Any program that cannot show that evidence today carries the same exposure.

Cited sources

• U.S. Treasury press release: record enforcement actions against Bank of America, 13 October 2026
• FinCEN Consent Order No. 2026-03 imposing a civil money penalty on Bank of America, N.A.
• OCC News Release 2026-89: $750 million assessment against Bank of America
• OCC civil money penalty consent order AA-ENF-2026-41
• OFAC Enforcement Release: Bank of America, N.A. settles for $11,662,930
• FinCEN release: record $1.3 billion penalty against TD Bank, 10 October 2024
• OCC News Release 2024-116: TD Bank cease-and-desist order and $450 million penalty
• 31 CFR 1020.320, reports by banks of suspicious transactions (eCFR)