The U.S. Treasury announced on October 13 that Bank of America will pay a combined penalty exceeding $1.21 billion for serious shortcomings in its anti-money-laundering (AML) and sanctions compliance programs. The enforcement action marks the third-largest fine ever levied by the Treasury Department, trailing only the $3.4 billion sanction on Binance in 2023 and the $1.3 billion assessed against TD Bank in 2024.
The penalty package consists of a $1.2 billion assessment from the Financial Crimes Enforcement Network (FinCEN), a $750 million sanction from the Office of the Comptroller of the Currency (OCC) – the largest ever issued by that regulator – and an $11.6 million settlement with the Office of Foreign Assets Control for alleged sanctions violations. The OCC fine will be credited against the FinCEN amount, rather than added on top of it.
What the regulators found
According to the Treasury’s consent order, the bank failed to monitor trillions of dollars in customer activity and omitted reports on more than $5 billion of suspicious transactions. Roughly $1 billion of those flows were tied to national-security concerns, including alleged links to Chinese money-laundering networks, narcotics trafficking, fraud schemes and potential trade-based laundering at the U.S. southwest border. The violations spanned the period from 2018 through 2025, covering transaction monitoring, customer-due-diligence and internal oversight mechanisms.
FinCEN concluded that Bank of America willfully breached the Bank Secrecy Act effectively outsourcing large portions of its suspicious-activity-detection duties to law-enforcement agencies and other financial institutions. Treasury officials also accused the bank of favoring revenue generation over compliance resources, allowing high-risk transactions to linger without proper investigation for extended periods.
Following the announcement, the bank’s shares slipped more than two percent in after-hours trading. In its upcoming third-quarter earnings release, the lender said it would record a non-tax-deductible charge of $1.2 billion, translating to an impact of roughly 17 cents per share on net income. The bank’s spokesperson emphasized that financial-crime compliance is a top priority, noting that billions of dollars have already been invested in advanced monitoring technology and that thousands of employees are dedicated to the effort.
As part of the consent order, Bank of America must appoint an independent third party to review its legacy data for any previously undetected suspicious activity. The institution also pledged to strengthen its internal controls, expand its risk-assessment framework, and fully cooperate with ongoing regulatory oversight.
