On October 13, 2026, the US Treasury announced penalties of more than $1.2 billion against Bank of America. One of the main findings was simple: the bank often learned about suspicious money from the police and other banks, instead of finding it itself.
This case is useful for any team that checks customers, suppliers or partners. It shows what can go wrong when warning signs are not acted on, and how long those signs can be public before a fine arrives.
What the regulators found
Three parts of the US Treasury took action on the same day. FinCEN said the problems ran from at least 2018 to mid-2025. Together, the regulators found that:
- Suspicious money went unreported. The bank failed to report over $5 billion in suspicious transactions on time. About $1 billion of that was linked to national security and other priority risks, including Chinese money laundering networks and money linked to the US southwest border.
- The bank relied on others. According to Treasury, the bank “effectively outsourced to third parties” a large part of its job of finding and reporting suspicious activity. In several years, more than one third of its investigations started because of outside events, such as requests from law enforcement.
- Foreign banks were not checked well enough. The bank failed to do proper checks on accounts it held for foreign financial institutions.
- The problems were known. The bank knew for years that suspicious activity was not being sent for review, but did not fix it. More than a year after a December 2024 order to fix its program, it was still not sending some suspicious activity for review.
- Revenue came first. Treasury said the bank “prioritized its revenues” over its compliance work.
Bank of America admitted to FinCEN that it willfully broke the Bank Secrecy Act, the main US law against money laundering. The bank said: “Financial crime compliance is serious, and we are responsible for getting it right.”
How big is this fine
- FinCEN: $1.2 billion. This includes a $750 million penalty from the OCC, the regulator of national banks, so the two should not be added together. The OCC penalty is the largest in its history.
- OFAC: a separate $11.66 million settlement for 475 apparent breaches of US sanctions.
Treasury called it the third-largest penalty in its history. Only Binance ($3.4 billion in 2023) and TD Bank ($1.3 billion in 2024) received larger FinCEN penalties.
For scale: according to the compliance software firm Fenergo, US penalties on financial firms for money laundering, customer checks and sanctions failures totaled about $1.68 billion in all of 2025. This one case equals about 72% of that. Note that 2025 was a low year, with US penalties down 61%.
One customer the bank kept
FinCEN’s order describes several customers without naming them. One of them, called Customer A, was an online marketplace for salvaged cars. It had banked with Bank of America since 1995.
- From 2020 to August 2022, the bank opened more than 100 money laundering cases on this customer. About 90% were about fraud.
- From late 2021 to mid-2022, the customer’s payments included more than $1.7 billion linked to countries bordering Russia.
- In mid-2022, the compliance team recommended considering closing the relationship. The business side pushed back. According to FinCEN’s order, the customer’s relationship manager argued that “a closure here would be detrimental given the impact of this relationship.”
- In March 2023, compliance withdrew its recommendation in favor of a plan to reduce the risk. Payments from third parties continued until June 2025.
A second customer, Customer B, publicly announced in November 2023 that the US Department of Justice was investigating its anti-money laundering practices. According to FinCEN, the bank’s risk model did not take that public announcement into account.
The sanctions part
OFAC, the office that enforces US sanctions, found 475 apparent breaches between 2021 and 2025. Among them:
- 403 payments worth about $14.3 million went through 35 banks that were already blocked under US sanctions, between February 2022 and March 2025.
- Some alerts were wrongly closed as false alarms, and one rule released flagged payments automatically.
- Exact matches on a sanctioned person’s name and date of birth were marked as low or medium priority.
The warning signs were public
The fine came in October 2026. But public signs of trouble appeared much earlier:
- December 23, 2024: the OCC ordered the bank to fix its anti-money laundering program. There was no fine at that point.
- June 29, 2026: the SEC fined Merrill Lynch, part of Bank of America, $7.5 million for failing to file hundreds of suspicious activity reports between 2020 and 2024. The SEC said the problem was the threshold used to decide which alerts to review: in Bank of America’s monitoring system, only groups of alerts with a risk score of 20 or more were looked at. Merrill neither admitted nor denied the findings.
- Early August 2026: the bank warned in a filing that it could face penalties. In February, it had said it did not expect the issue to have a “material adverse financial impact.”
- October 13, 2026: the $1.2 billion penalties were announced, about 22 months after the first order.
Conclusion: what this case teaches
- Do not wait for others to tell you. The bank relied on police and other banks to point out suspicious activity. Regulators treated that as a failure.
- Public information matters. A customer publicly said it was under investigation, and the bank’s risk model did not reflect it.
- Know who your partners deal with. Weak checks on foreign banks were one of the main findings.
- Warnings need follow-through. Compliance raised concerns about a high-risk customer, but the relationship continued for years.
- For anyone dealing with the bank, the signs were public early. A regulator’s order, a related fine and the bank’s own warning were all public months before the final penalty. Partners and investors could see them.
In this case, much of the information was already there. The hard part was noticing the signals that mattered, and acting on them in time.
Sources
Access Premium Insights
.avif)
.avif)
See Everything. Focus on What Matters.
svEye™ filters the noise to uncover meaningful patterns and insights. Gain clarity, stay informed, and drive smarter decisions with a comprehensive overview.
