Federal regulators say the nation's second-largest bank failed to investigate and report billions in suspicious transactions—even after earlier warnings. What did the bank admit, and what happens next?
October 13, 2026 | The Russell Record — Full & Fair Reporting
Story at a Glance
- The U.S. Treasury announced more than $1.21 billion in combined penalties involving Bank of America's anti-money-laundering and sanctions compliance.
- FinCEN says more than $5 billion in suspicious transactions were not timely reported, including more than $1 billion tied to priority national-security and illicit-finance risks.
- The bank admitted willful violations of the Bank Secrecy Act, which requires certain financial institutions to maintain safeguards and report suspicious activity.
- The OCC says major weaknesses persisted after a December 2024 cease-and-desist order.
- Independent reviewers must examine past transactions and the effectiveness of the bank's monitoring systems.
What happened on October 13?
Federal authorities announced a major enforcement resolution involving Bank of America, N.A., the U.S. bank that holds deposits and processes customer transactions. The Treasury Department's Financial Crimes Enforcement Network, commonly called FinCEN, assessed a $1.2 billion penalty after finding widespread failures in systems meant to identify and report potentially illicit transactions. The Office of the Comptroller of the Currency (OCC), a federal bank supervisor, concurrently imposed a $750 million assessment. Treasury's Office of Foreign Assets Control (OFAC) announced an additional $11.6 million settlement over apparent violations of U.S. sanctions restrictions.
Important accounting distinction: The OCC's $750 million is credited against FinCEN's $1.2 billion assessment. It is not a second $750 million to add on top of the $1.2 billion. With the separate OFAC settlement, Treasury describes the total as more than $1.21 billion.
What did regulators find?
FinCEN says Bank of America failed to timely report over $5 billion in suspicious transactions. More than $1 billion implicated particular national-security or illicit-finance risks, including activity suggestive of Chinese money-laundering networks, fraud, possible trade-based laundering and activity connected with the southwestern U.S. border.
The agencies described failures in customer due diligence, transaction surveillance, training, internal escalation, and suspicious activity reports—often called SARs. These reports alert authorities to patterns that warrant attention; they are not findings of guilt. FinCEN said the bank at times relied on outside inquiries from law enforcement or other banks rather than adequately identifying suspicious activity through its own controls. Some alerts went uninvestigated for extended periods.
In its FinCEN resolution, Bank of America admitted willful Bank Secrecy Act violations, including failures to maintain the required anti-money-laundering program, perform due diligence for certain foreign-bank relationships and file required SARs. These are acknowledged compliance violations. They do not establish that every flagged transaction involved a proven offense.
Why the 2024 warning matters
The OCC had already issued a cease-and-desist order in December 2024, requiring the bank to correct deficiencies. The agency says significant problems remained more than a year later, including failures to send potentially suspicious activity to investigators for review. The OCC also criticized insufficient staff expertise and training, ineffective internal auditing and a transaction-monitoring gap involving possible trade-based money laundering.
This distinction matters: regulators were not describing one newly discovered clerical error. They described long-running weaknesses that, in their account, management had not adequately fixed after formal intervention.
The separate sanctions violations
OFAC's $11.6 million settlement concerned 475 apparent violations across multiple U.S. sanctions programs. Treasury said these included payment-processing issues involving restrictions related to countries and activities such as Russia, Iran, narcotics and terrorism. OFAC classified the conduct as non-egregious and largely not voluntarily self-disclosed. The sanctions settlement is a separate matter from the broad anti-money-laundering program failures.
What Bank of America says
The bank acknowledged compliance failures and said it had invested in staff, technology and improvements to address the problems, according to reporting by Reuters and the Associated Press. Its resolution with FinCEN includes formal admissions. The relevant question going forward is not only whether new controls have been introduced, but whether independent testing shows those controls are effective.
The bank also disclosed a roughly $1.2 billion non-tax-deductible charge associated with the enforcement resolution, according to Reuters. That financial consequence is distinct from the broader cost of compliance improvements and any reputational damage.
What happens next?
FinCEN's consent order requires a third party to conduct a lookback review for suspicious transactions that went undetected or unreported. Independent reviewers must also assess transaction monitoring, customer due diligence, foreign correspondent banking and the integrity of data used in compliance systems. An independent review can identify further reporting obligations; it does not, by itself, predetermine criminal liability for underlying transactions.
There are competing policy considerations. Regulators argue that effective monitoring protects the financial system against fraud, trafficking, sanctions evasion and threats to national security. Banks must also process vast numbers of legitimate transactions, minimize false alarms, protect privacy and meet extensive compliance demands. The proper standard is not whether every possible suspicious transaction is blocked, but whether a bank operates effective, legally compliant risk-based controls and responds promptly when weaknesses are identified.
What remains unanswered?
The public enforcement announcements do not establish precisely how much of the suspicious activity ultimately constituted proven crime, whether additional individuals will face separate charges, or how soon remediation will satisfy regulators. Those questions require further evidence, not assumptions based on the scale of the reported transactions.
The bottom line
Bank of America faces a major financial penalty and extensive corrective obligations after regulators documented longstanding anti-money-laundering weaknesses. Its admissions make this more than an unresolved allegation of deficient compliance. Yet the $5 billion figure measures suspicious transactions that were not timely reported, not money conclusively proven to have been laundered. The most consequential next test is whether independent oversight shows the bank's systems now detect and report risk effectively.
