Treasury Imposes More Than $1.21 Billion in Penalties on Bank of America as Trend of Record-Setting AML and Sanctions Enforcement Continues

On October 13, 2026, the U.S. Department of the Treasury (“Treasury”) announced coordinated enforcement actions against Bank of America, N.A. (“Bank of America”).¹ Treasury’s actions impose more than $1.21 billion in penalties on Bank of America for violations of U.S. anti-money laundering (“AML”) and economic sanctions laws. Treasury describes the $1.2 billion penalty imposed by its Financial Crimes Enforcement Network (“FinCEN”) as the third-largest in Treasury’s history, behind FinCEN’s penalties against Binance in November 2023 and TD Bank in October 2024, so all three of Treasury’s largest penalties have come in the past three years.² Treasury Secretary Scott Bessent said the actions “send a clear message that even the biggest financial institutions are not above the law.”³

Treasury’s penalties were imposed by three of its agencies: the Office of the Comptroller of the Currency (“OCC”), the Office of Foreign Assets Control (“OFAC”), and FinCEN:

FinCEN and the OCC enforce overlapping BSA requirements under separate authority. FinCEN administers the BSA itself, while the OCC, as Bank of America’s primary federal regulator, enforces parallel BSA/AML programs and suspicious activity reporting requirements under its own regulations.⁴ FinCEN therefore credited the OCC’s $750 million penalty against its own $1.2 billion penalty. Bank of America pays $450 million under the FinCEN order, $750 million to the OCC, and $11.66 million to OFAC, for a total of approximately $1.21 billion.

Treasury’s Findings

FinCEN.⁵ In its resolution with FinCEN, Bank of America admitted that it willfully violated the BSA by failing to maintain an adequate AML program, conduct due diligence on correspondent accounts for foreign financial institutions, and file SARs. Between January 1, 2018, and July 1, 2025, the bank failed to timely report more than $5 billion in suspicious transactions, including over $1 billion tied to national security-related and other priority illicit finance risks, such as transactions indicative of Chinese Money Laundering Networks, fraud, and potential trade-based money laundering with a substantial nexus to the southwest border. FinCEN found that the bank prioritized revenue over compliance: the bank estimated internally that proper remediation would double case volumes and require roughly 750 additional staff, suggesting that it likely saved hundreds of millions of dollars by declining to make that investment. Internal warnings were disregarded; in one example, a senior executive had an unfavorable internal test repeated, and the second test labeled the original results “incorrect.” FinCEN also faulted the bank for effectively outsourcing detection, relying on law enforcement inquiries and requests from other banks rather than its own monitoring. In setting the penalty, FinCEN took into account that the bank’s cooperation was often unreasonably delayed and that the investigation was not prompted by self-disclosure. Although Bank of America had no prior enforcement history with FinCEN, its affiliate Merrill Lynch faced Securities and Exchange Commission actions in 2023 and 2026 for failing to file SARs.⁶

OCC.⁷ The OCC found that Bank of America’s BSA/AML compliance program was deficient and ineffective. A deficient transaction monitoring system left trillions of dollars in transactions improperly monitored and caused the bank to file large numbers of late SARs involving billions of dollars, many with indicia of money laundering. The bank’s BSA Officer and staff lacked sufficient skills and expertise, key personnel were not appropriately trained, and the bank’s BSA audit function failed to identify long-standing concerns that examiners later uncovered. The bank had been operating since December 2024 under an OCC cease-and-desist order requiring it to address its deficient BSA/AML program, but the OCC found that it did not complete many of the significant steps needed to do so; more than a year after that order, the bank still failed to escalate potentially suspicious activity to investigators for review. The OCC’s $750 million penalty is the largest in its history.

OFAC.⁸ OFAC identified 475 apparent violations totaling approximately $14.8 million between September 2021 and April 2025, spanning multiple sanctions programs, including Russia and Iran. Most involved payments routed through blocked banks by an automated tool that relied on a bank directory supplied by a third-party vendor; others stemmed from poorly prioritized screening alerts, delayed watchlist updates (one caused by a third-party vendor’s error), and staff error. That the routing directory came from a vendor, and that a vendor’s error caused one of the watchlist failures, did not shift responsibility for the payments: Bank of America processed them, and OFAC held it accountable. As OFAC put it, each organization “remains responsible for its own compliance regardless of whether it relies upon third-party providers.”⁹

OFAC assessed the full base penalty with no reduction, treating as aggravating factors the bank’s recklessness, its size and sophistication, the harm to U.S. sanctions objectives, and multiple prior OFAC cautionary letters for substantially similar conduct. OFAC’s cautionary letters carry weight under OFAC’s Enforcement Guidelines, which treat cautionary letters issued in the five years before a violation as part of an institution’s sanctions history and separately weigh the existence, nature, and adequacy of its compliance program.¹⁰

Non-Monetary Requirements

Beyond paying the penalties, FinCEN’s consent order requires Bank of America to engage independent consultants to conduct a SAR look-back and to independently test its transaction monitoring, customer due diligence, and foreign correspondent account due diligence.¹¹ A data governance review and ongoing FinCEN oversight are also required. The OCC’s new order assesses a civil money penalty, while remediation of the bank’s BSA/AML program continues under the OCC’s December 2024 cease-and-desist order.¹² As part of its settlement with OFAC, Bank of America also made compliance commitments regarding training, testing and audit, and future cooperation with the agency.

Lessons for Financial Institutions

Compliance programs must be tailored to the institution’s size and risk. Regulators expect AML programs to be risk-based and proportionate to an institution’s size, risk profile, and product mix. A program that may be adequate for a small or medium sized bank will not pass muster for a large financial institution.

Monitoring and screening are the institution’s own obligation. Relying on law enforcement inquiries or other banks’ referrals is not a substitute for internal detection. Nor does reliance on a vendor shift responsibility: Bank of America was penalized for payments routed using a vendor’s bank directory and for transactions processed during a vendor’s watchlist failure, because the bank, as the gatekeeper processing the transactions, was responsible for them.¹³ OFAC also expects institutions to keep “complete, accurate records” of how each potential match was investigated and resolved, and to report blocked or rejected transactions within ten business days.¹⁴

Red flags require timely action. Customer risk profiles must be updated throughout the relationship, and concerns must be acted upon. Documenting a problem or opening a prolonged internal review is not enough on its own, and a clean screening result does not end the inquiry. In May 2026, OFAC treated Adani Enterprises’ purchases of Iranian-origin liquefied petroleum gas as egregious because the company did not act on red flags such as third-party warnings, implausible claims of origin, and below-market pricing, or conduct diligence that may have revealed vessel tracking manipulation, even though it had know-your-customer procedures, none of the parties was sanctioned at the time, and its screening returned no matches. The supplier’s own bank stopped one payment, then released it after receiving apparently falsified shipping documents.¹⁵

Exposure lasts longer. In April 2024, Congress doubled the statute of limitations for civil and criminal violations of sanctions issued under the International Emergency Economic Powers Act and the Trading with the Enemy Act, from five years to ten, reaching any violation that occurred after April 24, 2019.¹⁶ Bank of America’s settlement, announced more than five years after its earliest apparent violations, shows how long that tail can run.

Training cannot be limited to compliance staff. At least one OFAC violation involved branch staff. Training must reach employees who handle customer transactions, not only specialists.

Expect little leniency for large institutions with prior warnings. Size, sophistication, and earlier cautionary letters were all treated as aggravating factors by OFAC. Prompt investigation, remediation, voluntary self-disclosure, and full cooperation are routes to potentially reduced penalties.

Integrate AML and sanctions functions. Treasury emphasized that the converging nature of AML, countering the financing of terrorism, and sanctions risks means compliance efforts should be integrated rather than siloed.

Seiden Law’s sanctions and anti-money laundering team is available to assist institutions in assessing their programs’ effectiveness, evaluating screening and monitoring controls, and responding to regulatory inquiries.

This article is provided for general informational purposes only and does not constitute legal advice. Readers should consult counsel concerning their particular circumstances.

1. U.S. Department of the Treasury, U.S. Treasury Announces Record Enforcement Actions Against Bank of America (Oct. 13, 2026), https://home.treasury.gov/news/press-releases/sb0657. ↩
2. Id.; U.S. Department of the Treasury, U.S. Treasury Announces Largest Settlements in History with World’s Largest Virtual Currency Exchange Binance for Violations of U.S. Anti-Money Laundering and Sanctions Laws (Nov. 21, 2023), https://home.treasury.gov/news/press-releases/jy1925; U.S. Department of the Treasury, Remarks by Deputy Secretary of the Treasury Wally Adeyemo at Press Conference at the Department of Justice (Oct. 10, 2024), https://home.treasury.gov/news/press-releases/jy2640. ↩
3. U.S. Department of the Treasury, supra note 1. ↩
4. Office of the Comptroller of the Currency, OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance (Oct. 13, 2026), https://www.occ.gov/news-issuances/news-releases/2026/nr-occ-2026-89.html; see 12 C.F.R. §§ 21.11, 21.21. ↩
5. See Financial Crimes Enforcement Network, Consent Order Imposing Civil Money Penalty, In the Matter of Bank of America, N.A., No. 2026-03 (Oct. 13, 2026), https://www.fincen.gov/system/files/2026-10/BoA-Consent-Order-Execution-Final.pdf. ↩
6. U.S. Securities and Exchange Commission, SEC Institutes Settled Order Against Merrill Lynch for Failing to File Suspicious Activity Reports (June 29, 2026), https://www.sec.gov/enforcement-litigation/administrative-proceedings/34-105790-s. ↩
7. Office of the Comptroller of the Currency, supra note 4. ↩
8. See Office of Foreign Assets Control, Bank of America, N.A. Settles with OFAC for $11,662,930 Related to Apparent Violations of Multiple Sanctions Programs (Oct. 13, 2026), https://ofac.treasury.gov/media/937231/download?inline. ↩
9. Id. ↩
10. 31 C.F.R. pt. 501, app. A, §§ III.D.4, III.E, https://www.ecfr.gov/current/title-31/subtitle-B/chapter-V/part-501/appendix-Appendix%20A%20to%20Part%20501. ↩
11. Financial Crimes Enforcement Network, supra note 5. ↩
12. Office of the Comptroller of the Currency, supra note 4. ↩
13. Office of Foreign Assets Control, supra note 8, at 1–3, 5. ↩
14. Office of Foreign Assets Control, FAQ No. 5 (updated Sept. 9, 2026), https://ofac.treasury.gov/faqs/5; see 31 C.F.R. §§ 501.603–.604. ↩
15. Office of Foreign Assets Control, Enforcement Release: Adani Enterprises Limited Settles with OFAC for $275,000,000 Related to Apparent Violations of Iran-related Sanctions (May 18, 2026), https://ofac.treasury.gov/media/935631/download. ↩
16. Office of Foreign Assets Control, Guidance on Extension of Statute of Limitations (July 22, 2024), https://ofac.treasury.gov/media/933056/download; see 50 U.S.C. § 1705(d). ↩