Bank of America has been hit with more than $1.21 billion in federal penalties after admitting to willfully violating US AML laws, following years of failures to identify and report suspicious transactions.
The case centres on $5 billion in transactions that the bank failed to report to authorities. More than $1 billion of the activity involved high-priority risks, including suspected Chinese money laundering networks, potential trade-based money laundering linked to the US southwest border, fraud and possible narcotics-trafficking proceeds.
But the scale of the missed transactions is only part of the story. Regulators had already ordered the bank to address AML deficiencies in December 2024. More than a year later, serious weaknesses remained.
So, how can a business invest billions in compliance technology and employ thousands of people to prevent financial crime, but still fail to identify and escalate suspicious activity? According to regulators, the answer llies in the difference between having compliance infrastructure and making sure it actually works.
A $5 billion warning that failed to reach investigators
The US’s Financial Crimes Enforcement Network (FinCEN) imposed a $1.2 billion penalty, while the Office of the Comptroller of the Currency (OCC) assessed a $750 million civil penalty, credited towards the FinCEN amount. The OCC’s penalty is the largest in its history. The Treasury also announced a separate $11.6 million settlement over apparent sanctions violations involving countries and activities including Iran, Russia, narcotics trafficking and global terrorism.
Bank of America admitted that it had willfully violated the Bank Secrecy Act by failing to maintain an adequate AML programme, conduct required due diligence on foreign correspondent accounts and file suspicious activity reports.
Regulators said that potentially suspicious transactions worth billions of dollars were not escalated to investigators in a timely or appropriate manner. The activity included warning signs associated with fraud, narcotics trafficking and possible trade-based money laundering.
The bank was not just dealing with an isolated oversight or a handful of unusual payments. The OCC found that it had failed to monitor transactions effectively across an enormous volume of activity, despite knowing for years that potentially suspicious transactions were not being escalated for review.
How were so many red flags missed?
The regulatory findings suggest that the failures were not caused by one defective system or one poorly handled transaction. Several weaknesses reinforced one another.
The monitoring system was not catching what it needed to catch
The OCC had identified serious problems with Bank of America’s transaction monitoring in its December 2024 cease-and-desist order. These included a systemic failure to establish appropriate thresholds for triggering investigations.
Transaction monitoring depends on identifying activity that warrants closer examination. If the thresholds are poorly designed, suspicious activity may never generate an alert. If the system is not properly calibrated to the bank’s customers, products, transaction volumes and risk exposure, the problem can persist even when the bank has sophisticated technology.
The OCC subsequently found that Bank of America continued to process potentially suspicious trade-based money laundering transactions because of a flaw in its monitoring programme.
The bank relied too heavily on others to identify suspicious activity
Treasury also criticised the bank’s reliance on law enforcement inquiries and referrals from other financial institutions to identify questionable transactions.
Those external reports can be valuable sources of intelligence. But they cannot replace a bank’s own responsibility to understand its customers, monitor their activity and investigate unusual transactions.
In effect, regulators said the bank had relied too heavily on others to identify suspicious activity that its own controls should have detected.
That creates a dangerous blind spot. If a business waits for an external complaint, regulatory inquiry or law enforcement referral before examining a transaction, it may already have missed the opportunity to identify a pattern, escalate concerns or file a report promptly.
Compliance staff lacked the necessary skills and support
The OCC also found that key compliance personnel, including the bank’s Bank Secrecy Act officer and staff, lacked sufficient skills and expertise to manage the programme effectively. Regulators linked these shortcomings to late and inaccurate suspicious activity reports.
A compliance function is only as effective as its ability to interpret the information in front of it. Staff need to understand what different warning signs mean, how to investigate them, when to escalate concerns and how to document decisions.
Training cannot be treated as a box-ticking exercise. Nor can an organisation assume that hiring more people or purchasing more technology will solve a problem if the people responsible for operating the system do not have the right expertise, authority or resources.
The findings also raise questions about management oversight. If staff are struggling to investigate alerts effectively, the organisation needs to understand why and address the underlying causes, rather than simply measuring the number of alerts processed or cases closed.
Commercial priorities overshadowed compliance
Treasury accused Bank of America of prioritising revenue while minimising the resources devoted to compliance. It also said management continued to minimise the significance of the programme’s deficiencies.
An organisation can have a detailed AML policy, a monitoring platform and a sizeable compliance team, but those safeguards will not be effective if commercial priorities consistently take precedence over risk management.
Pressure to reduce costs, accelerate onboarding, avoid delays or increase transaction volumes can create incentives to overlook warning signs. If senior management treats compliance failures as operational inconveniences rather than serious business risks, weaknesses are likely to persist.
Regulators’ criticism suggests that the issue was not simply whether Bank of America had invested in compliance, but whether it had given compliance the resources, authority and management attention needed to work.
A turning point that was missed in 2024
Perhaps the most damaging aspect of the case is that regulators had already identified serious deficiencies.
In December 2024, the OCC issued a cease-and-desist order requiring Bank of America to address weaknesses in its AML programme and compliance with the Bank Secrecy Act. The order identified problems with transaction monitoring and customer due diligence, including the failure to make acceptable substantial progress on an earlier customer due diligence issue.
The bank was on notice that its controls were inadequate. Yet the subsequent enforcement action found that significant breakdowns continued. Potentially suspicious activity was still not being escalated, and weaknesses in transaction monitoring allowed possible trade-based money laundering to pass through the system.
A remediation plan may contain milestones, revised procedures, new technology and additional training. But these measures are only meaningful if they address the underlying cause of the failure and produce demonstrable improvements.
Effective remediation requires testing whether the original weakness has actually been corrected, whether the change works in practice and whether similar problems exist elsewhere in the organisation.
Bank of America said it had invested billions of dollars in compliance technology and assigned thousands of employees to financial crime prevention. It also said it was making substantial progress towards completing the improvements required by regulators.
Those investments, however, did not prevent the enforcement action. The bank will now be required to engage an independent consultant to examine historical transactions, identify suspicious activity that escaped detection and report additional transactions where disclosure is required. Independent assessments of its monitoring systems, customer due diligence procedures and foreign correspondent accounts are also required.
The remediation exercise will therefore extend beyond demonstrating that new controls have been introduced. It will involve looking back at activity that the bank’s previous controls failed to identify.
The sanctions findings reveal another layer of risk
The AML failures were accompanied by a separate settlement with the Treasury’s Office of Foreign Assets Control (OFAC) over 475 apparent sanctions violations.
The settlement covered apparent violations involving several sanctions programmes, including those relating to Iran, Russia, Belarus, Burma, Somalia, narcotics trafficking and global terrorism.
The reported shortcomings included payments routed through blocked banks, transactions involving sanctioned individuals, delays in updating sanctions watchlists and errors involving restricted business accounts.
These findings highlight how weaknesses can span several areas of financial crime compliance. Sanctions screening, customer due diligence, transaction monitoring and suspicious activity reporting are distinct obligations, but they often depend on overlapping information, systems and governance arrangements.
What could Bank of America have done differently?
For starters, the bank needed a transaction monitoring framework that reflected the risks it actually faced. That means regularly testing whether monitoring rules and thresholds identify relevant patterns, including activity involving third parties, unusual transaction volumes and potentially suspicious international trade. Testing should include transactions that the existing system did not flag, rather than relying exclusively on the alerts it generates.
Next, the bank needed to ensure that alerts were investigated by appropriately trained and experienced staff. That includes clear escalation criteria, sufficient investigative capacity and quality assurance that examines whether decisions are sound, not simply whether cases have been closed within a target timeframe.
Third, management needed reliable evidence of how the programme was performing. Reporting should identify recurring weaknesses, overdue investigations, inaccurate or late filings, unresolved audit findings and areas where resources are insufficient. Senior leaders should be able to see whether the controls are working, rather than relying on assurances that a remediation plan is progressing.
Fourth, the bank should have treated the 2024 regulatory order as a fundamental control problem requiring demonstrable correction. Independent testing should have established whether the monitoring deficiencies had been resolved and whether suspicious activity was reaching investigators as intended. Any unresolved issues should have been escalated, properly resourced and tracked until the underlying risk was addressed.
Finally, the organisation needed to ensure that compliance had sufficient authority to challenge commercial decisions. When revenue targets and compliance requirements come into conflict, the controls must not become optional. The ability to identify and escalate risk must be built into everyday operations, rather than left to individual employees to defend against commercial pressure.
These measures cannot guarantee that every suspicious transaction will be identified. Financial crime controls inevitably involve uncertainty, and not every unusual transaction is criminal. But an effective programme should be able to demonstrate that its controls are proportionate to its risks, that warning signs are investigated and that known weaknesses are corrected promptly.
The case’s wider impact
Most organisations will never process transactions on the scale of Bank of America. They may not be subject to the same US regulatory requirements, and the specific suspicious activity reporting obligations will depend on their jurisdiction and sector.
But the central lesson is that compliance failures often emerge because a company’s policies and procedures do not translate into effective controls.
The Bank of America case also shows why organisations need to look beyond individual transactions. Activity that appears reasonable in isolation may become suspicious when viewed in the context of a customer’s wider behaviour, the source of funds, the parties involved or a significant change in the scale or pattern of transactions.
This requires staff to exercise judgement, ask questions and escalate concerns when an explanation does not make sense. It also requires organisations to make sure that those decisions are documented and that recurring problems are identified across the business.
There is an equally important lesson about remediation. If an audit, internal review or regulator identifies a weakness, organisations should not stop at updating a policy or recording that training has been completed. They need to establish why the failure occurred, whether it affected other clients or transactions, and what evidence will demonstrate that the problem has been resolved.
For smaller organisations, this does not necessarily require expensive technology or a large compliance department. It requires controls proportionate to the risks, clear responsibility for carrying them out, competent staff and a willingness to challenge procedures that are not working.
Compliance that works, not just on paper
Bank of America’s penalty is a reminder that the size of an organisation’s compliance budget is not a reliable measure of how well it manages financial crime risk.
The bank had technology, personnel and formal compliance arrangements. What regulators found was that significant weaknesses persisted, suspicious activity was not escalated appropriately and earlier instructions to improve the programme had not produced the necessary results.
For organisations of every size, the practical takeaway is to test the effectiveness of controls rather than simply confirm their existence.
Ultimately, effective AML compliance is not about producing the right paperwork or demonstrating that money has been spent. It is about making sure that suspicious activity is recognised, investigated and escalated when it matters and being able to prove that the system works.
