$1.2 Billion Wake-Up Call: Six AML Failures Behind the Bank of America Enforcement Action

When transaction monitoring, escalation, staffing, audit, and remediation all break down at once, the consequences can be enormous.

On October 13, 2026, FinCEN assessed a $1.2 billion civil money penalty against Bank of America for violations of the Bank Secrecy Act (BSA), while the OCC imposed a record $750 million penalty for deficiencies in the Bank’s BSA/AML compliance program. The OCC penalty is credited toward FinCEN’s $1.2 billion assessment. OFAC separately announced an approximately $11.6 million sanctions settlement, bringing the coordinated Treasury actions to more than $1.21 billion.

Beyond the financial penalties, these enforcement actions provide an important case study for AML professionals. They illustrate what can happen when weaknesses in transaction monitoring, alert escalation, suspicious activity reporting, staffing, training, independent testing, and governance persist without effective corrective action.

The findings highlight six significant AML failures that financial institutions should examine within their own compliance programs.

1. A Systemic Blind Spot for Trade-Based Money Laundering

The Failure: Bank of America had a systemic gap in its transaction monitoring program that left it without sufficient detective monitoring capabilities for certain activity indicative of trade-based money laundering (TBML).

FinCEN’s Consent Order describes weaknesses involving TBML monitoring and notes that a 2025 third-party review concluded the Bank did not maintain sufficient detective monitoring capabilities for suspicious activity associated with the TBML red-flag theme.

Why it Matters: TBML can be particularly difficult to detect because illicit value may be concealed within transactions that otherwise appear to involve legitimate commerce. The Consent Order discusses risks associated with used-vehicle auction and export activity, noting that used and salvaged vehicles can be used to move value across borders.

The OCC found that even after Bank of America entered into its 2024 enforcement order, the institution continued to process potential TBML transactions because of a systemic gap in its monitoring program.

Compliance Takeaway: The existence of transaction monitoring scenarios does not necessarily mean an institution has adequate coverage. Banks need to evaluate whether their scenarios, data, thresholds, segmentation, and alerting logic effectively address the risks associated with their customers, products, geographic exposure, and transaction activity.

2. Trillions of Dollars Were Not Properly Monitored, and Alerts Weren’t Escalated

The Failure: According to the OCC, deficiencies in Bank of America’s transaction monitoring system resulted in the Bank failing to properly monitor trillions of dollars in transactions. The institution had also known for years that potentially suspicious activity was not being escalated to investigators for review, yet failed to correct the problem.

Why it Matters: For large financial institutions, the effectiveness and scalability of transaction monitoring are especially important. When monitoring or escalation controls fail, generating a sufficient number of alerts is only one part of the concern. Institutions must also ensure that potentially suspicious activity is appropriately identified, prioritized, and routed through the investigative process.

An effective AML framework should provide a reliable progression from detection and alert generation through investigation, disposition, and, when appropriate, a suspicious activity report (SAR) filing.

Compliance Takeaway: Transaction monitoring effectiveness extends beyond alert generation. Institutions should test the entire alert-to-investigation process, including scoring, suppression, escalation, workflow logic, and whether higher-risk activity consistently reaches investigators for review.

3. Backlogs Led to Large Numbers of Late SARs

The Failure: Weaknesses in Bank of America’s transaction monitoring and escalation processes contributed to significant delays in suspicious activity reporting. The OCC found that deficiencies in the monitoring system caused the Bank to file large numbers of late SARs involving billions of dollars, many of which contained indicators of potential money laundering.

Why it Matters: Even when suspicious activity is ultimately identified, delays in investigation and reporting can substantially undermine the effectiveness of an AML program. Timely reporting is essential to ensuring that potentially relevant information reaches law enforcement when it may still be useful.

FinCEN’s regulations generally require banks to file a SAR within 30 calendar days after the initial detection of facts that may constitute a basis for filing, subject to applicable regulatory provisions.

Compliance Takeaway: Alert volumes, investigation queues, and case backlogs should not be viewed solely as operational performance measures. When they interfere with timely investigation and reporting, they can create significant BSA compliance exposure. Capacity planning and resource allocation should therefore be evaluated alongside transaction monitoring performance.

4. Insufficient BSA/AML Expertise and Training:

The Failure: The enforcement findings also identified significant weaknesses in the personnel responsible for managing Bank of America’s BSA/AML compliance program.

The OCC specifically found that the Bank’s BSA Officer and staff lacked sufficient skills and expertise to manage the program effectively. Key personnel had also not received appropriate training related to identifying, investigating, and reporting suspicious activity.

Why it Matters: Sophisticated monitoring technology cannot compensate for inadequate expertise among the personnel responsible for overseeing and maintaining it. AML professionals must be equipped to understand the institution’s risks, evaluate monitoring results, identify deficiencies, and exercise appropriate judgment throughout the investigative process.

In this case, the OCC connected deficiencies in personnel expertise and training to inaccurate and late SAR filings.

Compliance Takeaway: Adequate staffing involves more than maintaining sufficient headcount. Financial institutions should assess whether their AML personnel possess the experience, technical knowledge, and specialized training appropriate for the institution’s risk profile, products, systems, transaction complexity, and relevant money laundering typologies.

5. Independent Testing Failed to See What Examiners Saw

The Failure: Another significant finding involved the effectiveness of Bank of America’s independent testing function.

FinCEN found that the function failed to properly detect and describe issues associated with the effectiveness of the Bank’s primary transaction monitoring control. The OCC similarly stated that the BSA audit function failed to identify longstanding compliance concerns that examiners subsequently uncovered.

Why it Matters: Independent testing is a critical component of an effective AML compliance program. Its purpose is not simply to verify that policies, procedures, systems, and controls exist, but to evaluate whether those controls are functioning as intended and adequately addressing the institution’s identified risks.

When independent testing fails to identify material weaknesses, management may lack an accurate understanding of the institution’s exposure. Deficiencies can then remain unresolved until they are identified through regulatory examination or enforcement.

Compliance Takeaway: Effective independent testing should extend beyond documentation review. For transaction monitoring, testing should challenge data integrity, scenario coverage, model logic, thresholds, segmentation, alert escalation, case workflows, and governance. It should also assess whether the overall monitoring framework operates effectively against the institution’s identified risks.

6. Failure to Deliver on the 2024 Cease-and-Desist Order

The Failure: Perhaps the most concerning governance issue was Bank of America’s failure to complete corrective actions that regulators had already required.

The Bank was subject to a December 2024 OCC cease-and-desist order addressing deficiencies in its BSA/AML compliance program. However, more than a year after the order, the OCC found that the institution had not completed many significant steps necessary to establish an effective program.

The OCC specifically identified continuing failures to escalate potentially suspicious activity to investigators, along with the systemic TBML monitoring gap. Comptroller Jonathan V. Gould characterized the Bank’s response to its BSA deficiencies as “unacceptable.”

Why it Matters: Once a control weakness has been identified, documented, and incorporated into a formal remediation program, management is responsible for ensuring that corrective action is completed and effective.

Persistent deficiencies raise questions not only about the original control failures but also about management oversight, accountability, and the institution’s ability to execute its remediation commitments.

Compliance Takeaway: Repeat findings and ineffective remediation can turn an operational or technical deficiency into a much broader governance problem. Independent validation of corrective actions should assess whether deficiencies have been effectively resolved and whether the improvements are sustainable, rather than relying solely on management’s designation of an issue as complete.

The Bigger Lesson: AML Compliance Has to Work as a System

The Bank of America enforcement action is particularly instructive because the deficiencies were not confined to a single control, department, or process. They affected multiple interconnected components of the Bank’s BSA/AML compliance framework, from risk identification and transaction monitoring to alert escalation, investigation, SAR reporting, staffing, training, independent testing, management oversight, and remediation.

FinCEN stated that Bank of America admitted it willfully violated the BSA by failing to implement and maintain an AML program satisfying minimum BSA requirements, conduct required due diligence for correspondent accounts for foreign financial institutions, and file required SARs.

The broader lesson is that a sophisticated AML system is only as effective as the controls surrounding it. Transaction monitoring scenarios, alert generation, investigative resources, independent audits, and remediation plans all serve important purposes, but their effectiveness depends on how well they function together.

Financial institutions must be able to demonstrate that their AML control environment identifies relevant risks, escalates potentially suspicious activity appropriately, supports timely investigations and regulatory reporting, and addresses deficiencies when they are identified.

For BSA Officers, model validators, independent auditors, and Boards, this case underscores the importance of evaluating the AML program as an integrated framework rather than a collection of individual controls.

Six Questions Every Financial Institution Should Be Asking Now

The enforcement findings provide an opportunity for institutions to assess their own programs and consider several important questions:

• Are there material customer, product, geographic, or typology risks that our transaction monitoring program does not adequately cover?
• Could scoring, suppression, thresholds, segmentation, or workflow rules prevent meaningful alerts from reaching investigators?
• Are alert and case backlogs affecting the timeliness of investigations or SAR filings?
• Do our BSA/AML personnel have expertise appropriate for the complexity and risk profile of the institution?
• Is independent testing challenging transaction monitoring effectiveness rather than primarily confirming that controls exist?
• When weaknesses are identified, can management demonstrate that remediation was timely, independently validated, and sustainable?

One Final Thought

Known AML weaknesses that remain unresolved can ultimately become far more costly than addressing them promptly.

For BSA Officers, Boards, auditors, model validators, and other compliance professionals, the Bank of America enforcement action reinforces a fundamental principle of effective compliance management: identifying a weakness is only the beginning. What matters is whether the institution takes meaningful action to correct it.

Given the scope and persistence of the deficiencies described by regulators, the $1.2 billion penalty serves as a significant reminder of the financial and regulatory consequences of ineffective AML controls and inadequate remediation.