Bank of America Hit With More Than $1.21 Billion in AML and Sanctions Penalties

The U.S. Department of the Treasury announced more than $1.21 billion in penalties and settlements against Bank of America just recently, following notable failures in its anti-money laundering (AML) and sanctions compliance controls.

According to the Treasury Department, the bank failed to timely report more than $5 billion in suspicious transactions. More than $1 billion of this activity involved national security and other high-priority financial crime risks, including Chinese money laundering networks and suspected illicit financial activity along the U.S. southwest border.

The enforcement actions involve three U.S. authorities:

• Financial Crimes Enforcement Network (FinCEN): Assessed a $1.2 billion penalty for failures to mitigate and report priority illicit-finance risks.
• Office of the Comptroller of the Currency (OCC): Imposed a $750 million civil money penalty for deficiencies in the bank’s Bank Secrecy Act/AML compliance program. This amount is credited against FinCEN’s penalty.
• Office of Foreign Assets Control (OFAC): Reached an $11.6 million settlement over 475 apparent sanctions violations involving multiple sanctions programs, including those related to Iran, Russia, narcotics, and global terrorism.

What went wrong?

Regulators identified weaknesses in transaction monitoring, suspicious activity reporting, internal controls, staff expertise, and independent auditing. The OCC said the bank failed to properly monitor trillions of dollars in transactions and continued to experience significant compliance breakdowns despite a December 2024 enforcement order requiring improvements.

FinCEN also stated that Bank of America admitted to willfully violating the Bank Secrecy Act. The bank acknowledged the resolutions and said it had worked with regulators to address the identified deficiencies.

The enforcement actions require further remediation, including an independent review of previously overlooked suspicious transactions. The case highlights how weaknesses in monitoring and escalation processes can leave major financial crime risks undetected or reported too late.

Implications for Compliance Teams

• Review transaction monitoring coverage: Ensure monitoring rules cover the institution’s products, customer types, payment channels, and geographic risks.
• Strengthen suspicious activity reporting: Establish clear escalation procedures so alerts are investigated promptly and reporting decisions are properly documented.
• Assess correspondent banking risks: Apply appropriate due diligence to foreign financial institution relationships and review higher-risk cross-border activity.
• Check sanctions screening controls: Keep sanctions lists updated, investigate potential matches, and test screening effectiveness.
• Verify remediation independently: Compliance leaders should track overdue corrective actions and ensure internal audit can identify persistent weaknesses.

The case strongly emphasises that effective AML compliance requires more than written policies or automated alerts. Financial institutions need properly resourced teams, reliable monitoring systems, timely investigations, and independent oversight.