Bank of America Faces Historic Treasury Penalty Over Rampant AML Failures
Despite years of progressive regulatory scrutiny and the widespread implementation of increasingly-sophisticated financial surveillance systems, anti-money laundering (AML) failures continue to expose vulnerabilities in the international banking system. Unfortunately for all parties involved, when these compliance controls fail at major financial institutions, the consequences can extend well beyond corporate balance sheets to negatively affect national security, law enforcement and the integrity of the global financial system. As such, financial institutions small and large have been subjected, and rightly so, to staunch penalties and remediation actions for their respective roles in opening the door for illicit financial activity to prosper both domestically and abroad. In spite of the aforementioned advancements, multi-billion-dollar fines for non-compliance have remained prevalent over the past decade, with regulators still seeking to set an example for financial firms with more significant enforcement actions, while also actively addressing loopholes that remain in international anti-crime defenses.
The latest example of this phenomenon comes from Bank of America, which was recently struck with one of the largest financial penalties in U.S. history following findings that it failed to adequately detect and report billions of dollars in suspicious transactions over nearly a decade-long period. Last week, the U.S. Treasury Department levied a $1.21 billion penalty against the multinational firm after the agency’s Financial Crimes Enforcement Network (FinCEN), the bureau responsible for collecting and analyzing information about financial transactions to combat domestic and international money laundering, terrorist financing, and other financial crimes, ultimately found that the bank ultimately failed to mitigate and report priority national security risks, including activity associated with Chinese money-laundering networks and illicit finance along the U.S. southwest border,1 while also announcing an additional $11.6 million settlement through its Office of Foreign Assets Control (OFAC) for “numerous” sanctions violations in relation to programs covering Iran and Russia. Separately, the Office of the Comptroller of the Currency (OCC) imposed a $750 million civil money penalty, the largest in the agency’s history, against BOA for rampant deficiencies in the bank’s anti-money-laundering program.
In a press release following the action, Treasury Secretary Scott Bessent highlighted the important role that banks continue to play in the global fight against illicit finance. “Financial institutions are on the front lines of protecting our economic and national security,”1 adding that “when a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks.”1
At the center of the case are the bank’s failures with respect to suspicious transaction identification and reporting and subpar customer due diligence (CDD) processes. According to the Treasury, more than $5 billion in suspicious transactions went unreported to FinCEN over the period of 2018 to 2025, including approximately $1 billion associated with previously-identified “priority” national-security and illicit financial risks, a major issue for the second largest American financial institution in terms of total assets. The firm also allegedly failed to address countless red flags brought about when identifying transactions involving unknown third parties, which were later identified as being tied directly to illicit narcotics trafficking. The OCC also found that the bank’s compliance program remained deficient despite a December 2024 cease-and-desist order that called for corrective action to be taken to mend these shortcoming. Regulators ultimately found that more than a year later, significant gaps in these programs persisted, including failures to escalate potentially suspicious activity for investigation and systemic weaknesses that allowed potential trade-based money laundering transactions to be processed. All told, shortcomings in Bank of America’s transaction monitoring systems resulted in the Bank failing to properly monitor trillions of dollars in transactions, leading to large numbers of suspicious activity reports (SAR’s) involving billions of dollars being filed late (if filed at all) in spite of the unique money laundering indicators present in these transactions. SAR’s remain an important tool for banks to thwart money laundering activity, as these reports provide investigators with information that can help trace proceeds from fraud, drug trafficking and other offenses and ultimately uncover criminal networks. When these reports are delayed or misfiled, opportunities to disrupt illicit financial activity are often lost completely.
One of the most consequential criticisms that emerged following the investigation concerned the bank’s BSA Officers and compliance staffing reportedly lacking sufficient skills and expertise to effectively manage the firm’s BSA/AML program.1 This department was found to have relied more heavily than appropriate on external inquiries and requests from law enforcement and other financial institutions to identify the suspicious activity passing through their doors. Rather than consistently detecting risks through its own internal monitoring systems, the bank effectively relied on outside parties to flag transactions that its own controls should have identified, with the bank prioritizing revenue while minimizing the resources devoted to these vital compliance functions. While the bank has acknowledged their numerous shortcomings and reportedly invested billions of dollars towards upgrading compliance technology and employing thousands of qualified employees to combat financial crime, the damage is done. The growing connection between Chinese money laundering organizations and Mexican drug cartels has flourished in part from poor compliance protocols such as those maintained by Bank of America and other domestic firms, as well as failures in identifying the transactions between these parties and their affiliates, facilitating the expansion of this criminal partnership and adding fuel to the fire that is the opioid epidemic. Under the settlement, Bank of America must now engage an independent third party to review historical transactions and identify suspicious activity that was previously overlooked, with analysts anticipating significant findings in this regard as well.
Bank of America’s case, while significant, is far from an isolated incident. In October 2024, FinCEN assessed a record $1.3 billion penalty against TD Bank for widespread violations of the Bank Secrecy Act, the principal U.S. anti-money-laundering statute. Regulators found that TD Bank allowed significant monitoring and reporting deficiencies to persist for more than a decade, leaving trillions of dollars in annual transactions inadequately monitored for suspicious activity. In this case, the bank failed to file reports on thousands of suspicious transactions totaling approximately $1.5 billion.2 In total, the TD Bank resolution exceeded a whopping $3 billion across multiple authorities, including a $1.3 billion FinCEN penalty, a $1.8 billion Department of Justice resolution and additional regulatory measures. TD Bank also agreed to a four-year independent monitorship as part of their settlement.
Altogether, the Bank of America case reinforces a central principle of U.S. banking supervision, that being that modern compliance programs must be effective in practice, not merely on paper. Today institutions of all sizes are expected to understand the risks associated with their respective customers, products and transaction flows, while still being able to adapt to new, pervasive fraud and financial crime threats emerging on a daily basis or risk staunch financial penalties for non-compliance.
Citations
1. US Department of the Treasury. U.S. Treasury announces record enforcement actions against Bank of America. Published October 13, 2026.
2. Financial Crimes Enforcement Network. FinCEN assesses record $1.3 billion penalty against TD Bank. Published October 10, 2024.