Third-Largest Penalty in Treasury History; Largest in OCC History
WASHINGTON—Today, the U.S. Department of the Treasury announced enforcement actions imposing more than $1.21 billion in penalties against Bank of America (“the Bank”), the second-largest bank in the United States, for violations of anti-money laundering and sanctions laws. These actions include the third-largest penalty in Treasury history and the largest in the Office of the Comptroller of the Currency (OCC) history.
- The Financial Crimes Enforcement Network (FinCEN) assessed a $1.2 billion penalty for the Bank’s failure to mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border.
- The OCC assessed a $750 million civil money penalty for the Bank’s deficient and ineffective BSA/AML (anti-money laundering) compliance program.
- The Office of Foreign Assets Control (OFAC) announced an $11.6 million settlement agreement with the Bank over apparent violations of numerous sanctions programs, including on Iran, Russia, narcotics, and global terrorism.
“Financial institutions are on the front lines of protecting our economic and national security,” said Secretary Scott Bessent. “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks. Today’s actions send a clear message that even the biggest financial institutions are not above the law.”
Together, these actions underscore the importance of effectively complying with U.S. AML/CFT and sanctions requirements. Given the converging nature of AML/CFT and sanctions-related risks, financial institutions should ensure their AML and sanctions compliance efforts are effectively integrated and mutually reinforcing.
FAILURE TO REPORT OVER $5 BILLION IN SUSPICIOUS ACTIVITY TO FINCEN
As part of its resolution with FinCEN, Bank of America admits that it willfully violated the BSA and failed to (1) implement and maintain an AML program that met the minimum requirements of the BSA and FinCEN’s implementing regulations, (2) conduct due diligence for correspondent accounts for foreign financial institutions, and (3) file suspicious activity reports (SARs).
The central failures identified through FinCEN’s investigation involved deficiencies related to Bank of America’s suspicious transaction identification and reporting and customer due diligence (CDD) processes. As these issues arose, Bank of America prioritized its revenues and minimized the impact on its required compliance resources. The nature and extent of the Bank’s resulting reliance on law enforcement inquiries, requests by other financial institutions, and similar interventions over its own internal, automated controls to identify potentially suspicious activity meant that the Bank effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations. The Bank also allowed suspicious activity to accumulate uninvestigated for extended periods without investigation, resulting in late reporting of limited utility to law enforcement.
Bank of America maintained this approach and failed to take meaningful action even in the face of testing that highlighted significant problems. Similarly, the Bank’s CDD processes failed to account for customers’ extensive reliance on payments from unknown third parties. The Bank failed to timely and meaningfully respond to mounting red flags involving these customers—including potential ties to narcotics trafficking proceeds—even after compliance personnel escalated concerns related to possible trade-based money laundering and fraud.
As a result of these failures, Bank of America failed to timely report to FinCEN over $5 billion dollars in suspicious transactions, with over $1 billion of this activity implicating national security-related and other priority illicit finance risks, including suspicious transactions indicative of Chinese Money Laundering Networks, fraud, and potential trade-based money laundering with a substantial nexus to the southwest border.
The Consent Order published today requires Bank of America to work with a third party to complete a lookback to identify and report to FinCEN suspicious transactions that went undetected due to the failures noted above. Bank of America also must undergo an independent review of the effectiveness of its suspicious activity monitoring, CDD, and foreign correspondent account due diligence programs, as well as its data governance framework as it pertains to information used in its AML program. The independent reviews are tailored to the violations and will evaluate the effectiveness of Bank of America’s AML program in addressing priority risks, including (1) the U.S. Southwest border, cartels, and potential narcotics trafficking; (2) Iran; and (3) Russia.
Read FinCEN’s full Consent Order.
DEFICIENT AND INEFFECTIVE COMPLIANCE PROGRAM
The OCC’s penalty is in response to Bank of America’s violations of the Bank Secrecy Act and its implementing regulations, including 12 CFR 21.21 and 12 CFR 21.11. The Bank is also subject to a December 2024 cease-and-desist order (2024 Order), which required the bank to address its deficient BSA/AML compliance program.
The Bank’s BSA/AML compliance program is deficient and ineffective. Its transaction monitoring system resulted in the Bank failing to properly monitor trillions of dollars in transactions. This caused large numbers of late SARs involving billions of dollars. Many of the late SARs had indicia of money laundering. The Bank knew for years that it was failing to escalate potentially suspicious activity to investigators for review to determine if a SAR should be filed but failed to correct this serious BSA violation.
In addition, the Bank’s BSA Officer and staff lacked sufficient skills and expertise to effectively manage its BSA/AML program. Key BSA personnel did not receive appropriate training regarding suspicious activity identification, investigation, and reporting, which resulted in inaccurate and late SARs. The BSA audit function failed to identify longstanding BSA concerns that examiners subsequently uncovered.
After agreeing to the 2024 Order, the Bank still failed to prioritize BSA/AML compliance. The Bank did not complete many of the significant steps needed to establish an effective BSA/AML compliance program and its program continues to have significant breakdowns. For example, more than a year after the 2024 Order, the Bank still failed to escalate potentially suspicious activities to investigators for review. Additionally, the Bank processed potential trade-based money laundering transactions due to a systemic gap in its transaction monitoring program. Bank management failed to ensure the Bank had an effective BSA/AML compliance program and continued to minimize the program’s significant deficiencies.
APPARENT SANCTIONS VIOLATIONS ACROSS MULTIPLE PROGRAMS
The Bank has agreed to settle with OFAC its potential civil liability for 475 apparent violations of multiple sanctions programs. These apparent violations occurred when Bank of America channeled correspondent banking payments through blocked banks due to technical and human error, allowed designated individuals to make payments and withdraw funds due to poor sanctions alert calibration, failed to promptly update watchlists following OFAC designations, and mishandled business accounts associated with blocked persons due to human error. As a result of these compliance failures, Bank of America processed millions of dollars in payments in apparent violation of sanctions programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism.
The settlement amount of $11.6 million reflects OFAC’s determination that Bank of America’s apparent violations were non-egregious and largely not voluntarily self-disclosed. This settlement amount also reflects no reduction to the base penalty, including no mitigation for remedial measures or cooperation. As part of the settlement, Bank of America has made significant compliance commitments regarding training, testing and audit, and future communication and cooperation with OFAC.
Read OFAC’s full Enforcement Release.
COMPLIANCE CONSIDERATIONS
Effective AML/CFT programs protect U.S. national security by preventing financial institutions from being used to facilitate money laundering and terrorist financing. Such programs must be risk-based and commensurate with an institution’s size, risk profile, and products and services. In this matter, Bank of America failed to reasonably design its proprietary transaction monitoring system to address its risks and failed to make meaningful improvements despite testing that revealed significant deficiencies in identifying and timely reporting suspicious activity. Financial institutions cannot disregard mounting red flags or internal warnings about ineffective controls, whether under the guise of innovation or otherwise. Nor can they rely on law enforcement inquiries, referrals from other financial institutions, or other external sources as substitutes for their own effective internal monitoring and controls. Bank of America’s transaction monitoring failures resulted in material dependence on external referrals to identify potentially suspicious activity, rather than the Bank’s own controls to identify and investigate such activity.
Meaningful, risk-based customer due diligence is critical to meeting AML/CFT obligations. Financial institutions must maintain and update customer risk profiles throughout the customer relationship to reflect relevant information, including customer activity, products and services, and geographic exposure. When new information indicates heightened risks or raises AML/CFT concerns, financial institutions must take timely, meaningful action commensurate with those risks. Merely documenting concerns or engaging in prolonged internal reviews without appropriate corrective action does not satisfy an institution’s compliance obligations.
TREASURY WHISTLEBLOWER INCENTIVE PROGRAM
Through FinCEN, Treasury maintains a whistleblower incentive program for violations of the BSA and certain national security laws such as the International Emergency Economic Powers Act. Individuals located in the United States or abroad who provide information may be eligible for awards if the information they provide leads to a successful enforcement action that results in monetary penalties exceeding $1,000,000 and the statutory requirements in 31 U.S.C. 5323 are otherwise met. FinCEN is currently accepting whistleblower tips. More information about the whistleblower program can be found here.
###