Bank of America has been hit with more than $1.21 billion in US government penalties over failures in its anti-money-laundering controls and sanctions compliance, marking one of the largest enforcement actions against a major American bank. Announced on October 13, 2026, the action follows findings that the bank failed to properly identify, investigate and report more than $5 billion in suspicious transactions, including activity regulators linked to priority national-security and illicit-finance risks.
The enforcement action involves the US Department of the Treasury’s Financial Crimes Enforcement Network (FinCEN), the Office of the Comptroller of the Currency (OCC) and the Office of Foreign Assets Control (OFAC). Regulators cited weaknesses in transaction monitoring, internal investigations, staff expertise and suspicious-activity reporting. The bank has acknowledged violations related to its anti-money-laundering obligations and faces additional oversight and remediation requirements.
Key Takeaways
- More than $1.21 billion in penalties: The US Treasury announced enforcement actions against Bank of America on October 13, 2026.
- More than $5 billion in suspicious transactions: Regulators said the bank failed to report the activity as required.
- Record OCC penalty: The OCC assessed a $750 million civil money penalty, described as the largest in the regulator’s history.
- National-security concerns: Regulators highlighted risks involving Chinese money-laundering networks and illicit finance along the US southwest border.
- Sanctions violations: OFAC announced an $11.6 million settlement concerning apparent violations of multiple sanctions programs.
- Compliance changes required: The bank must address deficiencies and cooperate with additional review and remediation measures.
Why Was Bank of America Fined?
The enforcement action centres on weaknesses in Bank of America’s systems for detecting and reporting potentially suspicious financial transactions. US banks are required to maintain controls that help identify money laundering, illicit financing and other prohibited activity.
These requirements include monitoring transactions, investigating unusual patterns and filing Suspicious Activity Reports (SARs) with the appropriate authorities when the legal threshold is met. Such reports help law enforcement and financial-intelligence agencies identify potential criminal activity, trace funds and connect transactions across financial institutions.
According to FinCEN and the OCC, Bank of America’s anti-money-laundering programme had significant deficiencies. Regulators said the bank did not adequately escalate potentially suspicious transactions for investigation and failed to submit required reports in a timely and accurate manner.
The OCC also identified gaps in the expertise and training of personnel responsible for overseeing the bank’s compliance programme. It said the bank’s internal audit function failed to identify long-standing concerns that regulators later uncovered.
The action is particularly significant because regulators said the problems persisted after an earlier 2024 consent order. That history raised concerns about whether the bank had adequately addressed previously identified weaknesses.
The penalties do not mean every transaction cited was necessarily proven to involve a crime. The central regulatory issue is that the bank failed to meet legal obligations for monitoring and reporting suspicious activity.
How the $1.21 Billion Penalty Is Structured
The enforcement action involves three US government agencies. Their actions address related but distinct compliance obligations, and the amounts should not simply be added together because the FinCEN penalty credits the OCC’s penalty.
| Agency | Penalty or settlement | Main issue |
|---|---|---|
| Financial Crimes Enforcement Network (FinCEN) | $1.2 billion | Failure to mitigate and report priority illicit-finance risks |
| Office of the Comptroller of the Currency (OCC) | $750 million | Deficient anti-money-laundering compliance programme |
| Office of Foreign Assets Control (OFAC) | $11.6 million | Apparent violations of sanctions programmes |
| Overall enforcement action | More than $1.21 billion | Anti-money-laundering and sanctions compliance failures |
Source: US Treasury, FinCEN and OCC announcements dated October 13, 2026. The OCC penalty is credited against FinCEN’s $1.2 billion penalty; the amounts are not additive in the way a simple sum would suggest.
The $750 million OCC penalty is a record for that regulator. The Treasury described the broader enforcement action as the third-largest penalty in its history.
The OFAC settlement addresses apparent sanctions violations involving programmes related to countries and activities including Iran, Russia, narcotics and global terrorism. Sanctions enforcement is separate from the bank’s broader obligation to monitor and report suspicious transactions.
The combined action shows how one institution can face enforcement from multiple regulators when shortcomings affect different areas of financial compliance.
More Than $5 Billion in Suspicious Transactions Went Unreported
The Treasury said Bank of America failed to report more than $5 billion in suspicious activity. Within that amount, regulators identified approximately $1 billion associated with national-security-related and other priority illicit-finance risks.
The authorities highlighted Chinese money-laundering networks and illicit finance along the US southwest border. These areas are priorities for US financial-crime enforcement because illicit funds can support fraud, organised crime and other prohibited activity.
The reporting requirements are designed to give authorities visibility into transactions that might otherwise remain difficult to connect across accounts, institutions and jurisdictions. Banks do not need to establish that a crime has definitively occurred before filing a suspicious-activity report; the reporting framework is intended to flag activity that meets the applicable legal criteria for further examination.
A failure to file required reports can therefore limit investigators’ ability to identify patterns, trace funds and connect potentially related activity.
The distinction is important: the reported $5 billion figure describes suspicious transactions that regulators said were not properly reported. It should not be interpreted as a finding that Bank of America itself lost $5 billion or that every dollar in the transactions represented proven criminal proceeds.
Regulators Say Earlier Compliance Problems Were Not Fully Resolved
The OCC said Bank of America continued to experience significant weaknesses after a 2024 consent order. According to the regulator, the bank did not complete important steps needed to establish an effective anti-money-laundering programme.
The OCC identified several areas of concern:
- Weak transaction monitoring: Gaps in monitoring systems allowed potentially suspicious activity to proceed without adequate escalation.
- Delayed or inaccurate reports: The bank failed to file some required suspicious-activity reports promptly and accurately.
- Insufficient staff expertise: Key compliance personnel lacked adequate skills, experience or training to manage the programme effectively.
- Internal audit weaknesses: The bank’s audit function failed to identify long-standing issues later identified by examiners.
- Management oversight: Regulators said management did not adequately address the seriousness of the deficiencies.
These findings highlight the importance of treating compliance as an organisation-wide responsibility rather than a narrow administrative function. Effective systems require suitable technology, trained investigators, clear escalation procedures, independent testing and senior-management oversight.
Banks also need to demonstrate that problems identified by regulators are corrected in practice. Updating policies or investing in technology is not sufficient if transactions continue to pass through monitoring systems without appropriate review.
What the Penalty Means for Bank of America’s Earnings
A penalty of this size can affect a bank’s reported quarterly results, investor sentiment and compliance spending. Reuters reported that the enforcement action is expected to reduce Bank of America’s third-quarter earnings by approximately $1.2 billion, equivalent to about 17 cents per share.
The precise impact on the bank’s financial statements depends on the timing and accounting treatment of the charge. The penalty itself is a direct financial cost, while remediation may create additional expenses associated with technology, staffing, independent reviews and control improvements.
Investors will also assess whether the case points to wider operational weaknesses or primarily to specific compliance functions. The enforcement action does not, by itself, establish that the bank’s entire business model or overall balance sheet is impaired.
The longer-term financial implications will depend on the speed and effectiveness of remediation, the possibility of further regulatory action and whether the bank can demonstrate that its monitoring and reporting systems meet regulatory expectations.
Why Anti-Money-Laundering Controls Matter to the Banking System
Anti-money-laundering controls are a core part of the financial system’s defences against the movement of illicit funds. Banks handle enormous volumes of payments, deposits, transfers and international transactions. That scale makes automated monitoring necessary, but technology must be supported by trained personnel and reliable investigation processes.
Suspicious Activity Reports help financial-intelligence agencies identify potential patterns involving fraud, money laundering, sanctions evasion and other financial crimes. When a bank fails to file required reports, authorities may lose a valuable source of information.
The rules also apply to major institutions regardless of their size or market position. Regulators expect large banks to maintain controls proportionate to their transaction volumes, international reach and exposure to higher-risk customers and markets.
The Bank of America case underscores another challenge: compliance programmes can fail even when formal policies exist. Effective oversight requires institutions to test whether controls work in actual operations, investigate alerts consistently and correct recurring weaknesses.
What Happens Next?
Bank of America will need to address the deficiencies identified by regulators and comply with the applicable remediation and review requirements. FinCEN’s resolution includes remedial obligations, while the OCC’s action requires improvements to the bank’s anti-money-laundering programme.
Independent review and additional oversight can help determine whether previously overlooked activity requires further investigation and whether the bank’s controls have become effective. The process may involve reviewing transaction-monitoring systems, staff training, escalation procedures, reporting decisions and governance arrangements.
For investors, the next indicators will include the bank’s disclosures about the financial charge, compliance spending and progress against regulatory requirements. For the wider industry, the case is a reminder that enforcement risk can remain elevated when weaknesses persist after an earlier regulatory intervention.
The Bigger Picture
The Bank of America penalty illustrates how anti-money-laundering enforcement increasingly focuses on the effectiveness of financial institutions’ controls, not merely on whether policies exist on paper. Regulators are examining whether banks detect suspicious patterns, investigate alerts, file accurate reports and correct known weaknesses within an appropriate timeframe.
The action also demonstrates the interaction between financial-crime monitoring and sanctions enforcement. Although the obligations overlap in some cases, they serve different purposes: anti-money-laundering rules help identify and report suspicious funds, while sanctions programmes restrict specified transactions and
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
