Bank of America Fined $1.21 Billion: A Massive BSA/AML Compliance Failure and a Warning for Every Bank Audit Committee
October 13, 2026 | John C. Blackshire, Jr. Corporate Compliance Seminars
When a Major Bank Fails to Monitor Trillions of Dollars in Transactions
On October 13, 2026, the U.S. Department of the Treasury announced enforcement actions against Bank of America totaling more than $1.21 billion for violations involving the Bank Secrecy Act (BSA), anti-money laundering (AML) requirements, and U.S. economic sanctions.
The enforcement actions represent one of the most significant banking compliance cases of 2026.
The findings extend far beyond isolated transaction monitoring errors.
Federal regulators described widespread deficiencies involving suspicious activity monitoring, customer due diligence, regulatory reporting, compliance staffing, internal auditing, management accountability, and the failure to correct previously identified weaknesses.
Perhaps the most troubling finding was that Bank of America had known for years about certain compliance deficiencies but failed to correct them effectively.
The Bank of America enforcement action demonstrates what can happen when an institution identifies serious internal control problems but does not take effective corrective action.
For bank directors, Audit Committee members, compliance officers, and Internal Auditors, this case provides important lessons about corporate governance and regulatory accountability.
1. Understanding the $1.21 Billion Enforcement Action
Three federal agencies announced coordinated enforcement actions.
Regulatory agency | Announced penalty | Primary concern |
Financial Crimes Enforcement Network (FinCEN) | $1.2 billion | Willful BSA violations, AML program deficiencies, and suspicious activity reporting failures |
Office of the Comptroller of the Currency (OCC) | $750 million | Deficient and ineffective BSA/AML compliance program |
Office of Foreign Assets Control (OFAC) | Approximately $11.66 million | Apparent violations of U.S. economic sanctions |
Total, after applicable penalty credit | Approximately $1.212 billion | Combined enforcement resolution |
The $750 million OCC penalty is credited against FinCEN's $1.2 billion assessment.
Therefore, the penalties should not be added together as $1.96 billion.
FinCEN's penalty was the third-largest in Treasury Department history, while the OCC's penalty was the largest in that agency's history.
Bank of America admitted to willful violations of the BSA as part of its FinCEN resolution.
These penalties reflect serious failures in the institution's compliance infrastructure.
2. More Than $5 Billion in Suspicious Activity Was Not Timely Reported
One of the most significant findings involved the failure to timely report more than $5 billion in suspicious transactions.
According to Treasury, more than $1 billion of that activity involved national security-related or other priority illicit finance risks.
The activity included indicators associated with:
Chinese money laundering networks.
Potential narcotics trafficking.
Illicit financial activity along the U.S. southwest border.
Fraud.
Potential trade-based money laundering.
The issue was not merely that certain Suspicious Activity Reports (SARs) were submitted late.
Regulators described weaknesses that prevented potentially suspicious activity from being identified, escalated, investigated, and reported appropriately.
This represents a failure of the end-to-end suspicious activity monitoring process.
A bank must do more than generate automated alerts.
It must ensure that potentially suspicious activity reaches qualified investigators, receives timely evaluation, and results in appropriate decisions about regulatory reporting.
3. Transaction Monitoring Failed to Cover Trillions of Dollars Adequately
The OCC reported that Bank of America's deficient transaction monitoring system resulted in failures to properly monitor trillions of dollars in transactions.
For an institution processing hundreds of trillions of dollars annually, transaction monitoring is an essential internal control.
A properly designed monitoring program should address the institution's significant money laundering risks, products, services, customer relationships, and geographic exposures.
The Bank of America case raises important questions about:
Completeness of transaction monitoring populations.
Design and effectiveness of monitoring scenarios.
Data governance and system interfaces.
Alert generation and escalation.
Investigation backlogs.
Monitoring system validation.
Management reporting concerning system limitations.
The OCC also identified a systemic monitoring gap that allowed potential trade-based money laundering transactions to be processed.
A transaction monitoring system is not an effective control simply because it is operating. It must identify and escalate the types of suspicious activity relevant to the bank's risk profile.
4. The Bank Knew About Problems but Failed to Correct Them
The OCC reported that Bank of America had known for years that potentially suspicious activities were not being escalated appropriately for investigation.
Nevertheless, the problems persisted.
This is a particularly serious governance issue.
There is an important distinction between a newly discovered control deficiency and a known deficiency that management has failed to remediate.
When management becomes aware of a significant control weakness, it should evaluate the associated risk, develop a corrective action plan, assign accountability, and monitor implementation.
Repeated delays can increase regulatory exposure and undermine confidence in management's ability to maintain an effective compliance program.
In this case, regulators concluded that management did not respond adequately to significant compliance problems.
The lesson applies to institutions of every size.
Identifying a deficiency does not fulfill management's responsibility. Management must ensure that the deficiency is corrected.
5. The December 2024 Consent Order Was Not Enough
Bank of America had already entered into a cease-and-desist order with the OCC in December 2024.
That order required improvements to the bank's BSA/AML compliance program.
The requirements addressed major aspects of the compliance framework, including risk assessments and program remediation.
Yet regulators reported that significant deficiencies continued well after the order.
More than a year later, the bank still failed to escalate certain potentially suspicious activities for investigation.
The OCC also reported that Bank of America had not completed many important steps necessary to establish an effective compliance program.
This raises an important question for corporate governance:
How does a bank remain subject to a major regulatory enforcement order for nearly two years without resolving significant deficiencies?
The answer requires examining management accountability, remediation governance, independent validation, and the effectiveness of Board oversight.
The public enforcement findings establish that significant problems persisted. They do not, by themselves, establish what individual directors knew at particular times or whether particular Board members violated their duties.
Nevertheless, the circumstances demonstrate why Audit Committees should closely monitor remediation of significant regulatory findings.
6. The BSA Officer and Compliance Staff Lacked Necessary Expertise
The OCC identified deficiencies involving the qualifications and training of BSA compliance personnel.
According to the agency, the BSA Officer and staff lacked sufficient skills and expertise to manage the bank's BSA/AML program effectively.
Key personnel had not received appropriate training in:
Identifying suspicious activity.
Investigating unusual transactions.
Evaluating relevant financial crime indicators.
Preparing accurate SARs.
Meeting regulatory reporting requirements.
The OCC linked these deficiencies to inaccurate and late SAR filings.
This finding is particularly important because banks often focus on compliance software and automated monitoring while underestimating the importance of personnel competency.
Technology cannot compensate for an inadequately trained compliance function.
Management must ensure that compliance personnel possess the knowledge, experience, and authority necessary to fulfill their responsibilities.
7. Internal Audit Failed to Identify Longstanding BSA Problems
One of the most important findings for the auditing profession concerns the effectiveness of the bank's independent BSA testing.
The OCC stated that Bank of America's BSA audit function failed to identify longstanding concerns that regulators subsequently uncovered.
This is a major warning for Internal Audit Departments.
An independent BSA review should not be limited to confirming that policies exist, training was conducted, and required reports were filed.
It should evaluate whether the compliance program's controls are appropriately designed and operating effectively.
For example, Internal Audit should evaluate whether:
Transaction monitoring includes complete and accurate data.
Monitoring scenarios address significant financial crime risks.
Alerts are escalated appropriately.
Investigations are timely and adequately documented.
SAR decisions comply with regulatory requirements.
Significant compliance deficiencies are communicated to management and the Board.
Corrective actions are independently validated.
The OCC's findings raise questions about whether the audit function had the necessary risk assessment methodology, technical competency, testing procedures, and professional skepticism.
The publicly released findings do not establish the precise cause of every audit failure.
However, they clearly demonstrate that the independent testing function did not provide effective identification of significant longstanding deficiencies.
Internal Audit must provide meaningful assurance about the effectiveness of BSA controls—not simply confirm that the bank maintains a compliance program.
8. Customer Due Diligence and Foreign Correspondent Banking Weaknesses
FinCEN identified significant weaknesses in customer due diligence.
According to Treasury, certain customer risk profiles did not adequately account for extensive payments from unknown third parties.
The bank also failed to respond promptly and meaningfully to mounting warning signs involving certain customer relationships.
Some concerns had already been escalated by compliance personnel.
These matters included possible connections to trade-based money laundering, fraud, and narcotics trafficking proceeds.
FinCEN also identified failures involving due diligence for correspondent accounts maintained for foreign financial institutions.
These findings reinforce the importance of understanding customer activity throughout the banking relationship.
Customer due diligence is not completed when an account is opened.
Banks must evaluate significant changes in customer behavior and respond when new information indicates elevated risk.
9. Reliance on Outside Parties Instead of Internal Controls
A particularly troubling aspect of the enforcement action was Bank of America's reliance on external sources to identify potentially suspicious activity.
Treasury described the bank as depending substantially on information from law enforcement, other financial institutions, and similar outside interventions instead of its own proactive monitoring controls.
This is a fundamental failure of the control environment.
A bank cannot rely on regulators, law enforcement, or other institutions to perform its own compliance monitoring responsibilities.
External referrals are valuable sources of information.
However, they should supplement an effective internal monitoring program rather than replace it.
The distinction is important for management and Audit Committees.
A bank that learns about suspicious activity primarily through external inquiries may have a serious problem with the design or operation of its internal controls.
10. OFAC Identified 475 Apparent Sanctions Violations
The coordinated enforcement action also included an OFAC settlement of approximately $11.66 million involving 475 apparent sanctions violations.
The problems included:
Processing payments involving blocked financial institutions.
Inadequate prioritization or calibration of sanctions screening alerts.
Delays in updating sanctions watchlists.
Human errors involving accounts associated with blocked persons.
Processing transactions involving sanctioned jurisdictions or designated parties.
The sanctions programs involved Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism.
OFAC classified the apparent violations as non-egregious but largely not voluntarily self-disclosed.
The settlement illustrates the importance of integrating sanctions compliance with broader financial crime risk management.
Sanctions screening depends on reliable data, timely watchlist updates, appropriately configured systems, qualified personnel, and effective exception handling.
11. What the Case Reveals About Management's Internal Control Responsibilities
The Bank of America enforcement action should be examined through the lens of internal control governance.
Management is responsible for establishing and maintaining the organization's internal control framework.
That includes identifying risks, designing controls, ensuring personnel competency, monitoring performance, and correcting deficiencies.
The COSO Internal Control—Integrated Framework provides a useful analytical structure.
COSO component | Governance concern illustrated by the case |
Control Environment | Management accountability, compliance culture, and personnel competence |
Risk Assessment | Inadequate identification and response to significant illicit finance risks |
Control Activities | Weak transaction monitoring, customer due diligence, and sanctions screening |
Information and Communication | Failure to escalate suspicious activity and communicate relevant concerns |
Monitoring Activities | Ineffective independent testing and delayed remediation |
These are analytical connections to COSO, not a formal COSO assessment of Bank of America's entire control environment.
A formal evaluation would require additional evidence about control design, operating effectiveness, and compensating controls.
Nevertheless, the case illustrates why all five COSO components matter.
A bank can have extensive written policies and still experience serious compliance failures when controls do not operate effectively.
12. What Should the Bank's Audit Committee Have Been Asking?
The OCC findings create important questions about Board and Audit Committee oversight.
The Audit Committee's specific responsibilities depend on the bank's governance structure and delegated authority.
However, effective oversight should include challenging management about significant BSA/AML risks and the reliability of independent assurance.
Relevant questions include:
Why were known transaction monitoring deficiencies not corrected promptly?
Did management provide complete and accurate reporting about significant BSA/AML weaknesses?
What evidence supported management's representations that remediation was progressing?
Were significant regulatory findings tracked through a formal corrective action process?
Did the Board receive meaningful information about unresolved high-risk findings?
Was the BSA Officer adequately qualified, trained, and resourced?
Why did independent BSA testing fail to identify longstanding deficiencies?
Were transaction monitoring systems independently validated?
Were compliance concerns escalated without inappropriate interference?
What procedures confirmed that corrective actions were operating effectively?
The critical issue is whether the Board received sufficient information to evaluate the effectiveness of the compliance program and management's remediation efforts.
Audit Committees should not accept management assurances without considering the evidence supporting those assurances.
13. What Bank Internal Auditors Should Do Now
The Bank of America case provides an opportunity for Internal Audit Departments to reassess their BSA/AML audit programs.
A targeted review should consider five areas.
First: Transaction Monitoring
Evaluate whether the bank's monitoring system covers relevant transaction populations and addresses significant money laundering risks.
Second: Alert Investigation and SAR Reporting
Test whether alerts are investigated, escalated, documented, and reported within applicable regulatory requirements.
Third: Customer Due Diligence
Determine whether customer risk profiles are updated when significant changes occur.
Fourth: Compliance Personnel Competency
Evaluate whether the BSA Officer and compliance personnel possess the expertise and resources required by the institution's risk profile.
Fifth: Corrective Action Governance
Review significant outstanding findings, management's remediation plans, and independent validation of completed actions.
Internal Audit should use a risk-based approach and obtain sufficient appropriate evidence to support its conclusions.
14. The Regulatory Response: Independent Reviews and a Lookback
FinCEN's October 13, 2026 resolution requires Bank of America to undertake additional remediation.
Among the requirements are:
Working with a third party to conduct a lookback for suspicious transactions that may have gone undetected.
Identifying and reporting relevant suspicious activity.
Obtaining independent reviews of suspicious activity monitoring.
Evaluating customer due diligence.
Reviewing foreign correspondent account due diligence.
Assessing data governance supporting the AML program.
The reviews are intended to address important risks, including illicit finance associated with the southwest border, Iran, and Russia.
These requirements demonstrate that financial penalties are only one component of regulatory enforcement.
The bank must also demonstrate that it can establish and maintain an effective compliance program.
15. Ten Lessons for Every Bank
The Bank of America enforcement action offers lessons that apply to institutions much smaller than Bank of America.
Management owns BSA/AML compliance. Responsibility cannot be transferred entirely to the BSA Officer or an outside consultant.
Transaction monitoring must be effective. Operating a system is not proof that relevant risks are being detected.
Data governance matters. Incomplete or unreliable information can undermine monitoring.
Compliance personnel must be competent. Training and expertise are fundamental controls.
Suspicious activity must be investigated promptly. Unresolved alerts create compliance and reporting risks.
Customer due diligence must be ongoing. Risk profiles should reflect significant changes in activity.
Internal Audit must challenge management. Independent testing must identify significant control weaknesses.
Regulatory findings require disciplined remediation. Corrective action plans must lead to verified improvements.
The Board needs meaningful reporting. Management should proactively communicate significant risks and deficiencies.
Compliance culture must be demonstrated through actions. Policies and statements are not substitutes for effective controls.
The Bottom Line: This Was a Governance and Internal Control Failure
Bank of America's $1.21 billion enforcement resolution is a reminder that regulatory compliance failures often extend beyond individual transactions or isolated procedural errors.
The regulators described a combination of ineffective monitoring, insufficient personnel expertise, weaknesses in customer due diligence, inadequate independent testing, and management's failure to correct longstanding problems.
The most important lesson is that an organization can know about significant internal control weaknesses and still fail to address them.
That is where governance becomes critical.
Management must own the internal control framework, the BSA Officer must administer an effective compliance program, Internal Audit must provide credible independent assurance, and the Board must oversee significant risks and management's corrective actions.
A bank's compliance program should be judged by whether its controls identify, investigate, and respond to financial crime risks—not by the number of policies, reports, systems, or committees it maintains.
The Bank of America case should prompt every bank to examine whether its own BSA/AML compliance program is operating as intended.
Learn More: Bank Secrecy Act (AML/BSA) Basics and Compliance
Corporate Compliance Seminars provides professional training covering the Bank Secrecy Act, anti-money laundering requirements, compliance responsibilities, and the internal controls needed to manage financial crime risks.
The Bank Secrecy Act (AML/BSA) Basics and Compliance course is relevant to banking professionals, compliance officers, Internal Auditors, risk managers, and individuals involved in bank governance.
Course information and registration:
Comments