Bank of America fined $1.21bn after external warnings exposed monitoring gaps

On 13 October 2026, the U.S. Treasury announced coordinated enforcement actions imposing more than $1.21 billion in penalties on Bank of America for anti-money laundering and sanctions failures. FinCEN assessed $1.2 billion, while the Office of the Comptroller of the Currency imposed $750 million, which is credited against FinCEN’s penalty rather than added to it. A separate OFAC settlement of $11.6 million brought the combined amount above $1.21 billion.

Under the FinCEN resolution, the bank admitted the cited Bank Secrecy Act violations. FinCEN says weaknesses in the bank’s AML programme, customer due diligence and foreign-correspondent controls contributed to more than $5 billion in suspicious transactions being reported late or not identified in time between January 2018 and July 2025. Roughly $1 billion involved national-security or other priority illicit-finance risks.

A central finding was the bank’s dependence on signals arriving from outside its automated controls. FinCEN says that, during multiple years, more than one-third of suspicious-activity investigations were prompted by external or manual events, including law-enforcement referrals, requests from other financial institutions and subpoenas. For some higher-risk customers, most investigations began only after an external request arrived.

The monitoring system grouped alerts at customer level and generally waited until a combined risk score reached a threshold before opening a case. FinCEN found that important design choices lacked sufficient empirical support, that risk weights and thresholds were not updated meaningfully despite testing, and that suppression rules could prevent or delay investigation. After thresholds were changed in December 2023, a limited lookback identified nearly 8,900 SARs that had not been filed, covering almost $4 billion in activity.

The findings also reached beyond transaction rules. FinCEN says CDD processes did not adequately reflect some customers’ extensive use of payments from unknown third parties, even as internal staff raised concerns about possible trade-based money laundering and fraud. The OCC separately found that the programme remained deficient after a December 2024 cease-and-desist order, citing weak escalation, insufficient expertise and training, and an audit function that failed to identify longstanding problems.

The orders require an independent lookback and reviews of suspicious-activity monitoring, CDD, foreign-correspondent due diligence and the data governance supporting the AML programme. Bank of America told Reuters that it accepts responsibility for financial-crime compliance, has invested substantial resources in remediation and is committed to completing the required work.

External referrals are useful intelligence, but they cannot become the main detection mechanism. A request from law enforcement or another institution often arrives only after risk has already materialised. Internal controls still need to identify unusual activity independently and early enough for investigation and reporting to remain useful.

For KYB teams, this starts with the quality of the customer profile. Expected products, transaction volumes, counterparties, geographies and funding patterns need to describe how the business should actually operate. If a customer begins receiving extensive payments from unknown third parties, that change should update the risk profile and monitoring treatment rather than remain isolated in transaction data.

The case also shows why the existence of a sophisticated scoring system does not prove that monitoring is effective. Thresholds, weights, time windows and suppression rules can make workloads manageable while still filtering out genuine risk. They need empirical validation against false negatives, current typologies and the institution’s actual customer and product mix, with every change preserved in the audit history.

Detection speed matters as much as detection coverage. Allowing alerts to accumulate for months before a case is opened can weaken the investigation and delay reporting. Time-based escalation, backlog visibility and links between customer changes and monitoring triggers are therefore part of effective continuous monitoring, not merely operational metrics.

Finally, every external warning should become feedback for the control environment. Teams need to determine why the customer, account or transaction was not surfaced internally, whether the same gap affects other relationships and what rule, data or decision logic needs to change. Connected data coverage and a reconstructable decision trail make that learning possible.