Bank of America $1.21 Billion Penalty Raises the Bar for AML and Sanctions Controls

On 13 October 2026, the U.S. Treasury announced parallel actions against Bank of America that together exceeded $1.21 billion, making the matter one of the largest combined AML and sanctions enforcement outcomes in recent years. FinCEN assessed a $1.2 billion civil penalty, with $750 million credited against the OCC’s separate penalty, while the OCC imposed a record $750 million civil money penalty and OFAC settled 475 apparent sanctions violations for $11.6 million. The case targeted failures across the bank’s anti-money laundering program, suspicious activity reporting, correspondent account due diligence, and sanctions controls. Regulators tied those failures to massive operational scale: FinCEN said the bank failed to report more than $5 billion in suspicious transactions on time, including over $1 billion linked to national security and other priority illicit finance risks, while the OCC said monitoring weaknesses affected trillions of dollars in activity.

The facts matter because they show what U.S. regulators now view as unacceptable in a large-bank control environment. FinCEN said the bank leaned too heavily on subpoenas, law enforcement requests, and signals from other institutions instead of identifying suspicious activity through its own monitoring. The OCC concluded that the bank’s BSA/AML program remained deficient even after a December 2024 cease-and-desist order. OFAC found that sanctions breaches were not driven by one isolated breakdown, but by a mix of stale routing data, poorly calibrated alert logic, delayed list updates, and human handling failures.

This was not a criminal plea, but it was a severe civil resolution with admissions that the bank willfully violated core BSA duties in the civil enforcement sense. It also came with a long remediation runway. FinCEN required multiple independent reviews, including suspicious activity monitoring effectiveness testing, a SAR lookback, due diligence reviews, and data governance work extending through 2028. For CCOs and MLROs, the message is direct: examiners are no longer focused only on whether a control exists. They are testing whether it is evidence-based, staffed, timely, integrated, and capable of surfacing risk before an outside party does.

Operational Duties After the Bank of America Enforcement Action

Rebuild monitoring so internal controls detect risk before outside parties do

The clearest expectation from this case is that transaction monitoring must work as a primary detection engine, not as a passive filter that waits for law enforcement requests, subpoenas, or counterparty inquiries to do the real investigative work. FinCEN treated the bank’s dependence on external triggers as evidence that its own controls were not operating effectively. That is a meaningful shift in how large institutions should think about monitoring performance. It is no longer enough to show that alerts exist. Compliance teams need to show that the system is independently surfacing meaningful risk in time for investigation and action.

The operational friction is obvious. Many institutions still rely on threshold structures, scoring weights, and review windows that were set years ago and then left in place even as customer behavior, payment corridors, and typologies changed. Once that happens, alert volumes can look manageable while real risk sits below escalation thresholds. Teams then discover the problem only when regulators, law enforcement, or another bank points to specific activity. That creates a dangerous false sense of control.

Supervisory pressure will now focus on governance around model calibration, threshold evidence, and responsiveness to testing results. If internal validation, tuning exercises, or lookbacks show the system is missing risk, regulators will expect documented action rather than debate, delay, or attempts to reinterpret the findings. They will also want to see that alert prioritization and escalation rules are producing timely investigations rather than pushing suspicious activity into long aggregation windows that delay SAR decisions.

Treat customer risk profiling and due diligence as live controls, not onboarding paperwork

The enforcement action also reinforces that customer due diligence is not a one-time file creation exercise. FinCEN criticized customer risk profiles that failed to reflect third-party payment activity, international exposure, trade-based money laundering indicators, and sanctions evasion risk. In other words, the institution had information that should have changed how certain relationships were rated and monitored, but the profile did not move with the risk.

That gap is common in practice. Frontline onboarding teams may collect strong baseline information, but downstream ownership for ongoing profile maintenance is often blurred. Escalations from investigators, sector-specific typology alerts, or changes in customer behavior do not always feed back into the customer record. The result is a high-risk relationship operating under controls designed for a lower-risk customer, which weakens both surveillance and decision-making.

Regulators now expect institutions to connect customer behavior, investigator findings, and adverse risk indicators into an updated risk view. If a customer starts receiving heavy third-party payments, expands into higher-risk corridors, or shows trade patterns inconsistent with the original business profile, that should drive a clear reassessment. Supervisors will also expect institutions to show that business pressure does not override documented compliance concerns, especially where staff have recommended offboarding or tighter controls.

Tighten correspondent account due diligence across branches, affiliates, and nested activity

A major lesson from the case is that correspondent due diligence obligations do not become lighter simply because the foreign respondent sits within the same corporate group. FinCEN found that files for certain foreign branches and affiliates lacked clear information about the purpose of the accounts, expected activity, and the underlying customer types using those channels. That matters because correspondent risk often hides behind broad labels such as treasury services or cash management while actual usage includes non-bank financial institutions and other higher-risk flows.

The operational problem here is structural. Intra-group relationships are often treated as lower-friction arrangements because the entities are familiar, commercially important, and subject to some level of shared governance. That can lead to simplified documentation, assumptions about expected traffic, and limited challenge around nested relationships. But U.S. regulators are signaling that familiarity is not a substitute for specific, current due diligence.

For compliance teams, that means documenting what each correspondent relationship is for, what activity is expected, what customer segments sit behind it, and whether those underlying users introduce money laundering or sanctions exposure beyond the stated account purpose. Supervisors are likely to probe whether institutions can evidence that understanding and whether periodic reviews actually test for drift between assumed and actual activity.

Integrate sanctions screening governance with AML escalation and reporting

The OFAC settlement is a reminder that sanctions failures are often workflow failures, not just screening failures. The cited issues included payments routed through blocked banks, exact matches that were not prioritized correctly, delayed watchlist updates, and manual handling errors on blocked accounts. Treasury also emphasized the broader point that AML and sanctions controls should be integrated because the underlying risks increasingly overlap.

This creates pressure on firms that still run sanctions review as a narrow screening utility rather than part of a wider financial crime response model. If list updates fail, if suppression rules are not tightly governed, or if alerts are triaged in ways that understate true exposure, the institution can process prohibited activity before anyone recognizes the break. The same is true when sanctions alerts, customer risk signals, and transaction anomalies sit in separate teams with weak escalation paths between them.

Regulators now expect strong control over watchlist currency, alert prioritization, false-positive governance, and manual decision quality. They also expect escalation into investigation and reporting workflows when sanctions issues reveal broader customer or transactional risk. That means sanctions operations cannot be treated as a standalone technical control. They need governance, auditability, and clear links into broader AML case handling.

Penalties and Enforcement Risk

This action shows how quickly enforcement exposure compounds when AML program weaknesses, SAR failures, due diligence gaps, and sanctions breaches all point to the same underlying governance problem. Regulators did not treat these as isolated defects. They treated them as evidence of a program that failed to detect, escalate, and remediate known risk at enterprise scale.

• FinCEN assessed a $1.2 billion penalty — the third-largest in the agency’s history — for willful failure to maintain an AML programme, conduct foreign correspondent due diligence, and file suspicious activity reports on time.
• The OCC imposed a $750 million penalty, its largest ever against a bank, and emphasized that serious weaknesses continued after a prior cease-and-desist order.
• OFAC settled 475 apparent violations for $11.6 million and gave no reduction to the base penalty, despite classifying the case as non-egregious.
• FinCEN said the bank likely saved hundreds of millions in compliance spending, showing that underinvestment can directly influence penalty posture.
• The resolutions did not release potential claims against current or former directors, officers, or employees, leaving open the possibility of follow-on scrutiny for individuals.
• The remediation burden runs well beyond the monetary penalty, with consultant-led reviews, lookbacks, governance testing, and filing obligations extending through 2028.

For senior compliance leaders, the enforcement risk is broader than the fine itself. Once regulators conclude that a firm ignored internal warnings, delayed corrective action, or allowed commercial priorities to outrank control effectiveness, every other weakness in the framework becomes easier to frame as reckless rather than accidental.

How KYCsphere Addresses These Obligations

The operational challenge in this case is not simply a missing policy. It is a breakdown between detection, escalation, investigation, and documented response. Institutions need workflows that connect risk signals quickly enough for compliance teams to act before regulators decide the control environment is reactive by design.

Turn monitoring into a proactive detection workflow

The first fix is to make suspicious activity detection measurable, timely, and reviewable at the workflow level. Compliance teams need visibility into which scenarios are creating meaningful alerts, how quickly those alerts move to analyst review, and where escalation bottlenecks are delaying action. That helps firms challenge stale thresholds, shorten long review cycles, and prove that internal controls are identifying risk without waiting for law enforcement or another bank to raise the issue.

Just as important, investigators need a consistent process for documenting why an alert was closed, escalated, or converted into a case. That creates an audit trail around tuning decisions and supports defensible evidence when examiners ask whether testing results led to real changes. KYCsphere supports this with transaction monitoring to surface suspicious patterns and alert management to route, prioritize, and track alert handling from first detection through escalation.

Keep customer risk ratings aligned with changing behavior

The practical response to weak customer profiling is to treat the customer record as a living control file. When new activity suggests third-party payment risk, cross-border exposure, unusual trade behavior, or sanctions-related concern, the workflow should force a reassessment rather than leave that information buried in analyst notes. That gives compliance teams a stronger basis for changing monitoring intensity, requesting more information, or recommending restrictions and exit decisions.

This also reduces the gap between frontline onboarding assumptions and what investigators later discover. A stronger operating model links customer profile maintenance to actual transactional behavior and documented escalation outcomes. KYCsphere addresses this through customer risk assessment for dynamic risk segmentation and customer due diligence to capture, refresh, and evidence the higher-risk information needed for ongoing review.

Add structure and evidence to correspondent due diligence reviews

For correspondent relationships, the workflow fix is disciplined documentation and periodic review tied to actual account use. Compliance teams need a repeatable way to record the relationship purpose, expected activity, jurisdictions involved, and the types of underlying customers or financial institutions using the channel. That makes it easier to test whether a supposedly low-risk intra-group arrangement is in fact carrying higher-risk nested activity.

A structured review process also helps institutions show examiners that they are not relying on group familiarity as a proxy for due diligence. When information changes, reviewers can update the file, trigger enhanced review, and document why the relationship remains acceptable. KYCsphere supports that control discipline through customer due diligence to maintain documented correspondent profiles and review evidence.

Connect sanctions screening to investigation and escalation controls

The sanctions lesson from this case is that screening only works when list management, alert handling, and investigative follow-up are connected. Institutions need current watchlists, clear handling rules for exact and close matches, governed suppression logic, and a workflow that sends meaningful sanctions hits into case review fast enough to stop prohibited activity. That is especially important where sanctions indicators also suggest broader AML concerns.

An integrated workflow also helps reduce manual decision risk. Analysts can work from one controlled queue, escalate recurring issues consistently, and preserve a complete record for audit and disclosure decisions. KYCsphere supports this by combining sanctions screening with case management so sanctions alerts can move into documented investigation, escalation, and remediation without breaking the audit trail.

Building a Control Model That Examiners Can Trust

The Bank of America action is a warning that scale does not excuse weak control design, delayed remediation, or fragmented ownership across AML and sanctions teams. FinCEN, the OCC, and OFAC all focused on whether the institution could detect risk early, escalate it correctly, and act on its own findings without waiting for outside intervention. That is the standard large institutions should now plan against.

With remediation deadlines stretching into 2028 and examiner scrutiny rising across monitoring, due diligence, and sanctions operations, compliance leaders need operating models that can stand up to sustained testing. To evaluate where current controls are likely to break under that pressure and see what a more defensible workflow looks like in practice, schedule a demo or book a discovery call with the KYCsphere team.