The Reports That Never Reached FinCEN
A compliance system has one job: notice. Bank of America’s did not, according to US regulators. US regulators fined the country’s second-largest bank $1.21bn on 13 October 2026 for widespread failures to detect potential money laundering and other illicit activity. The breakdown matters more than the headline figure: the Treasury said the bank failed to report more than $5bn in suspicious activity to the government, including $1bn that posed national security-related and other priority illicit-finance risks.
The timeline is not short. The consent order (a negotiated settlement agreement between a regulator and a company) alleges the conduct tied to the penalty occurred from 2018 through 2025, and Bank of America admitted that it willfully violated anti-money laundering laws (the rules that force banks to watch for and report money from crime) as part of its resolution with FinCEN, the Treasury’s financial crimes unit. This was not one bad quarter or a single missed alert. It was a stretch of years in which the bank’s own controls were supposed to be the first line of detection, and the Treasury says they were not.
The Office of the Comptroller of the Currency (the US bank regulator) levied a $750m civil penalty against the lender — the largest the regulator has ever imposed. Its stated basis was a failure to address shortcomings in the bank’s anti-money laundering programs that had been identified in a 2024 cease-and-desist order (a formal regulator order to stop a practice) from the same watchdog, and a transaction monitoring system that caused the bank to delay filing suspicious activity reports on billions of dollars of transactions. The regulator called the compliance program “deficient and ineffective.” [1] Financial crime compliance is serious, and we are responsible for getting it right,” a Bank of America spokesperson said in a statement. “We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime, and our team is far along with and committed to completing the work required to address the issues raised by our regulators.” The bank says the work is not finished.
Where Revenue Outranked Compliance
The Treasury’s diagnosis of cause is blunt. In building its compliance programs, the bank “prioritized its revenues,” and it relied too heavily on inquiries from outside parties — law enforcement, other financial institutions — instead of its own internal controls. [1] The chain is mechanical. Activity that should have been reported accumulates instead; the filings that would have flagged it never arrive; and the cost lands as a penalty plus an outside reviewer plus remediation work — the work of fixing problems a regulator has found — that the bank says it is still completing. The Treasury’s finding is that revenue priority led to dependence on outside inquiries, which led to a $1.2bn bill.
Three authorities produced the total. The OCC’s share is $750m and the Office of Foreign Assets Control’s (the Treasury unit that enforces sanctions) is $11.6m, with the rest falling under the FinCEN settlement — and the Treasury describes the overall figure as the third-largest penalty in the department’s history. “Financial institutions are on the front lines of protecting our economic and national security,” the treasury secretary, Scott Bessent, said. “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire US financial system to significant illicit finance risks.” He also said: “Today’s actions send a clear message that even the biggest financial institution(s) are not above the law.”
The sanctions component carries its own arithmetic. The bank paid an $11.6m fine to the Office of Foreign Assets Control for 475 apparent violations of multiple sanctions programs (government bans on doing business with named people, firms or countries). The payments at issue exceeded $14m and reached sanctioned individuals and banks connected to Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism — money the Treasury says the bank mistakenly processed.
The remedy is not a payment. Under the consent order, Bank of America must hire an independent third party to review past transactions, identify the suspicious activity the bank failed to detect at the time, and report those transactions to FinCEN. Detection, in effect, is being outsourced after the fact: an outsider, paid by the bank, reporting to the government on what the bank’s own systems did not catch.
What Unwatched Dollars Eventually Buy
The gap had content. The Treasury alleged that some transactions were “indicative of Chinese Money Laundering Networks, fraud, and potential trade-based money laundering with a substantial nexus to the southwest border” — a practice that means hiding illegal money in the prices or paperwork of trade deals. [1] The endpoints named in the sanctions violations include banks connected to narcotics and to global terrorism.
The cost lands first on the income statement. Bank of America said its third-quarter results, due the day after the announcement, would include a non-tax-deductible charge (an expense the company cannot write off against its taxes) of $1.2bn, reducing quarterly net income by approximately 17 cents a share. Analysts had estimated adjusted earnings per share (per-share profit after excluding one-off items) of $1.10, according to mean estimates compiled by LSEG — a figure that by definition excludes one-off items such as this fine.
Investors moved before the details settled. The shares were down 2.7% in after-hours trading, having closed the regular session down 1.1%. The UBS analyst Erika Najarian wrote that the penalty is likely to add to negative investor sentiment and raise concerns about higher expenses and about whether the bank can maintain its roughly $6bn quarterly share buyback pace, adding that the shares would probably underperform at the open. She noted there was no asset cap — the regulatory penalty that would limit how large the bank could grow.
Nor is this confined to one institution. The fine came days after American Express was hit with a $350m penalty for similar anti-money laundering shortcomings.
The penalty is a transfer of money, and the third-party review looks only backward at transactions already gone. The question the numbers do not answer is what happens to the payments in the meantime — the activity the Treasury ties to Chinese money laundering networks and to a substantial nexus with the southwest border, and the routes to banks connected to narcotics and global terrorism. A fine prices a failure; it does not close one.
Sources
Mentioned organisations (context, not sources)
- Bank of America — Organisation (homepage)
- FinCEN — Organisation (homepage)
- U.S. Department of the Treasury — Organisation (homepage)
- Office of the Comptroller of the Currency — Organisation (homepage)
- Office of Foreign Assets Control — Organisation (homepage)
- LSEG — Organisation (homepage)
- UBS — Organisation (homepage)