This explanation by Mr. Tripathi will bring more understanding to issues banks need to address if we are going to do better at preventing fraud and money laundering. In the case below, Bank of America was fined $1.2 billion for failing to meet its AML obligations satisfactorily.
This post is very helpful in providing the main links to the decision rendered on Bank of America by US federal regulators. These sources can be found at the bottom of the article
Bank of America’s $1.21 Billion AML Enforcement Case
HRC EDD Analyst @ RBC Capital Markets
October 21, 2026
A bank may have transaction monitoring systems, customer due diligence procedures, compliance teams and internal audits in place. But with all of these control systems in place, how can a bank still fail to identify and escalate suspicious activity?
On October 13, 2026, enforcement actions against Bank of America provide a significant example of the consequences of ineffective anti-money laundering (AML) controls. U.S. authorities announced more than US$1.21 billion in penalties relating to Bank Secrecy Act (BSA)/AML failures and apparent sanctions violations.
1. What happened?
On October 13, the U.S. Department of the Treasury announced three enforcement actions:
- FinCEN: a US$1.2 billion penalty for failures involving AML obligations and the timely reporting of suspicious activity.
- Office of the Comptroller of the Currency (OCC): a US$750 million civil money penalty for a deficient and ineffective BSA/AML compliance program.
- Office of Foreign Assets Control (OFAC): a US$11.6 million settlement over 475 apparent violations of multiple U.S. sanctions programs.
The case is particularly notable because this was not the first regulatory intervention. The OCC had issued a cease-and-desist order in December 2024 requiring the bank to address deficiencies in its AML program. In October 2026, the OCC said significant weaknesses remained despite that earlier order.
That raises a critical question: if weaknesses have already been identified, what prevents an institution from correcting them effectively and sustainably?
2. The monitoring and reporting failures
FinCEN said Bank of America failed to report more than US$5 billion in suspicious transactions promptly. More than US$1 billion of this activity involved national-security-related and other priority illicit-finance risks, including suspicious activity indicative of Chinese money laundering networks.
The OCC also said deficiencies in the bank’s transaction monitoring system meant it failed to properly monitor trillions of dollars in transactions, resulting in large numbers of late suspicious activity reports (SARs). Regulators stated that many of those late reports involved indicators of money laundering.
A monitoring system can produce data and alerts, but that alone does not demonstrate that the institution is identifying risk effectively. Timing as well plays a very critical role. The ability to report in a timely manner is as important as the control systems initially placed.
3. Sanctions compliance
Bank of America agreed to settle potential civil liability for 475 apparent sanctions violations. According to OFAC, these included payments involving blocked banks, insufficient prioritisation of sanctions alerts, delays in updating watchlists following new designations, and errors involving accounts associated with blocked persons. The settlement covered sanctions programs involving Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism.
4. The governance question: what happens after a warning?
Perhaps the most striking aspect of the case is the history preceding the October 2026 enforcement actions.
The OCC said the bank’s AML program remained deficient despite the December 2024 cease-and-desist order. It also identified weaknesses in staff training, compliance expertise, escalation processes and internal audit.
Even a well-designed monitoring system cannot compensate for every weakness in governance, resourcing, investigation or decision-making. Likewise, identifying a control deficiency through testing is only useful if the institution takes effective corrective action.
According to Treasury, the required remediation includes a third-party lookback to identify suspicious transactions that were previously missed, alongside independent reviews of suspicious activity monitoring, CDD, correspondent banking due diligence and relevant data governance.
These measures are intended to address past gaps and evaluate whether the bank’s controls are working effectively. Their implementation and the findings from subsequent reviews will be important parts of the remediation process.
5. Key takeaways
As I continue developing my knowledge of AML and Capital Markets EDD, this case has reinforced three things for me.
First, having controls is not the same as having effective controls. Their performance needs to be tested against the institution’s actual risks, and identified weaknesses need to be addressed.
Second, due diligence must be connected to ongoing activity. Understanding a client’s profile is important, but so is recognising when real-world activity no longer fits that profile.
Third, governance and escalation matter as much as detection. A red flag that is identified but not investigated or acted upon may still represent a significant control failure.
The Bank of America case is a reminder that AML effectiveness depends on the entire process; this goes from understanding the customer and monitoring activity to investigating concerns, reporting suspicious transactions and correcting weaknesses.
Sources
