“Financial crime compliance is serious, and we are responsible for getting it right. We worked with regulators to reach these penalty resolutions stemming from violations cited in the previously reported 2024 OCC Consent Order and FinCEN’s investigation. We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime, and our team is far along with and committed to completing the work required to address the issues raised by our regulators," a BoA spokesperson said.

"We will continue to support federal and local law enforcement across thousands of investigations and report hundreds of thousands of suspicious activity reports each year. Our third-quarter results will include a non-tax-deductible charge of $1.2 billion impacting net income by approximately 17 cents per share. We have already dedicated substantial personnel and resources to our ongoing remediation efforts, and those costs are in the current expense base," the bank. 

The Financial Crimes Enforcement Network assessed a $1.2 billion penalty. The OCC levied a $750 million civil money penalty for a deficient and ineffective BSA/AML compliance program. The Office of Foreign Assets Control reached an $11.6 million settlement over apparent breaches of sanctions programs covering Iran, Russia, narcotics and global terrorism.

In its resolution with FinCEN, Bank of America admitted that it wilfully violated the Bank Secrecy Act. It failed to maintain an adequate AML program, conduct due diligence on correspondent accounts for foreign financial institutions and file suspicious activity reports. FinCEN said the bank failed to report more than $5 billion in suspicious transactions on time, the US Treasury said in a statement yesterday. 

More than $1 billion of that activity involved priority risks, including Chinese money laundering networks, fraud and potential trade-based money laundering tied to the southwest border.

FinCEN said the bank prioritized revenues and limited compliance resources. It relied on law enforcement inquiries and referrals from other institutions rather than its own monitoring, in effect outsourcing much of its detection obligations to third parties. The bank also failed to act on test results that exposed weaknesses, and on red flags escalated by its own compliance staff.

The OCC said the bank’s monitoring system failed to properly screen trillions of dollars in transactions. Its BSA officer and staff lacked sufficient expertise. The bank has been subject to an OCC cease-and-desist order since December 2024, and the regulator said significant breakdowns continued more than a year after that order. The 2024 order carried no monetary penalty, but Bank of America said in its latest quarterly filing that it was continuing to discuss a resolution with the OCC. 

The OFAC settlement covers 475 apparent violations. OFAC judged them non-egregious and largely not voluntarily self-disclosed and gave no credit for remediation or cooperation.

Under the FinCEN consent order, the bank must hire a third party to conduct a lookback and report undetected suspicious transactions. It must also commission independent reviews of its monitoring, due diligence and data governance, focused on the southwest border and cartels, Iran and Russia. The Treasury did not say which business lines were involved.

“When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls,” Scott Bessent, Treasury Secretary, said.

The action follows the 2024 case against TD Bank, the first bank in US history to plead guilty to Bank Secrecy Act program failures. The OCC imposed a $450 million civil penalty on TD Bank in that case.