Bank of America fined $1.2 billion by US authorities in landmark AML and sanctions enforcement action

Washington, October 14, 2026 — Bank of America has been hit with $1.21 billion in penalties by three US regulators after years of failures in its money laundering and sanctions controls allowed billions of dollars in suspicious transactions to go unreported and hundreds of payments involving sanctioned parties to pass through the banking system.

The coordinated enforcement action by the Financial Crimes Enforcement Network (FinCEN), Office of the Comptroller of the Currency (OCC) and Office of Foreign Assets Control (OFAC) exposed widespread deficiencies in the bank's financial crime controls, including failures to detect suspicious activity, inadequate customer due diligence and weaknesses in sanctions screening. FinCEN imposed a $1.2 billion penalty for willful violations of the Bank Secrecy Act, while the OCC assessed a record $750 million penalty that will be credited against FinCEN's assessment rather than added to it. OFAC separately announced an $11.66 million settlement covering 475 apparent sanctions violations.

According to FinCEN, Bank of America failed to report more than $5 billion in suspicious transactions in a timely manner, including over $1 billion associated with national security threats and priority financial crime risks. The transactions involved suspected Chinese money laundering networks, narcotics trafficking, fraud and potential trade-based money laundering linked to the US southwest border.

Investigators found that the bank frequently relied on inquiries from law enforcement and other financial institutions to identify suspicious activity rather than detecting it through its own monitoring systems. Significant volumes of potentially suspicious transactions remained uninvestigated, while weaknesses in customer due diligence allowed warning signs to go unaddressed.

The OCC identified additional deficiencies in transaction monitoring systems responsible for scrutinising trillions of dollars in transactions, alongside inadequate staff training, insufficient compliance expertise and ineffective internal auditing.

Regulators were particularly critical of the bank's failure to address longstanding weaknesses despite a December 2024 cease-and-desist order. More than a year later, suspicious transactions were still not being consistently escalated for investigation, raising questions about management oversight and the effectiveness of remediation efforts.

Separately, OFAC's $11.66 million settlement concerned 475 apparent violations of sanctions programmes targeting Russia, Belarus, Iran, Burma, Somalia, narcotics trafficking and global terrorism.

The violations involved payments processed through blocked banks, failures to appropriately prioritise alerts where customers' names and dates of birth exactly matched sanctioned individuals, delays in updating sanctions watchlists following new designations and human errors involving accounts associated with blocked persons.

OFAC classified the violations as non-egregious but determined that most had not been voluntarily self-disclosed. The agency said the failures demonstrated the importance of effective sanctions screening, timely list updates and appropriate investigation procedures. Bank of America acknowledged the compliance shortcomings and said it had invested billions of dollars in technology and deployed thousands of employees to strengthen its financial crime controls.

As part of the FinCEN resolution, the bank must undertake an independent retrospective review to identify previously undetected suspicious transactions and submit any necessary reports. Its transaction monitoring, customer due diligence, correspondent banking controls and data governance will also face further independent scrutiny.

The combined enforcement action underscores the growing overlap between sanctions compliance and anti-money laundering obligations, with regulators increasingly examining whether financial institutions can identify illicit activity across both areas rather than treating them as separate compliance functions.

It also sends a warning to financial institutions that longstanding weaknesses in sanctions screening and transaction monitoring can result in substantial penalties, particularly where deficiencies persist despite previous regulatory intervention.