Bank of America FinCEN Consent Order: $1.2 Billion AML Penalty Explained

On 13 October 2026 the US Financial Crimes Enforcement Network (FinCEN) assessed a civil money penalty of about $1.2 billion against Bank of America, N.A. The same day the Office of the Comptroller of the Currency (OCC) announced a $750 million penalty of its own, which FinCEN's figure credits, and the Office of Foreign Assets Control (OFAC) announced an $11.6 million sanctions settlement. For anyone studying or working in anti-money laundering (AML), the FinCEN consent order is worth reading closely, because it shows how a very large bank's transaction monitoring, customer due diligence and suspicious activity reporting can fail together. If you are building your knowledge, our CPD courses include AML and financial crime training.

This guide summarises what FinCEN and the OCC said, the control failures they describe, and the practical lessons for compliance teams of any size. It is based on the FinCEN news release, FinCEN consent order number 2026-03 and the OCC news release 2026-89. We read the order through a summarising tool and parts were truncated, so check every figure against the original documents before you quote them.

What happened: the three actions

FinCEN's news release says the bank failed to address and report priority national security risks, including Chinese money laundering networks and illicit finance along the US southwest border. As part of the resolution the bank admits it willfully violated the Bank Secrecy Act (BSA). It admits it did not maintain an AML programme meeting the BSA's minimum requirements, did not carry out required due diligence on correspondent accounts for foreign financial institutions, and did not file required suspicious activity reports (SARs).

The OCC described its $750 million civil money penalty as the largest in its history. It cites violations of the BSA programme and SAR rules and notes that the bank has been subject to an OCC cease-and-desist order since December 2024 requiring it to fix its BSA/AML compliance programme. FinCEN's news release lists the OFAC settlement of $11.6 million as relating to apparent violations of several sanctions programmes, including those covering Iran, Russia, narcotics and global terrorism.

The OCC says FinCEN's penalty credits the OCC amount, so the two US penalties should not simply be added together. Some press reports give a headline total of about $1.21 billion, which differs from the way the individual amounts add up, so treat any single "total fine" figure with care and use the amounts stated by each agency.

The legal basis

The consent order cites the main BSA building blocks that every AML professional should know. They include the requirement for an AML programme (31 U.S.C. 5318(h) and 31 C.F.R. 1020.210), due diligence for correspondent accounts of foreign financial institutions (31 U.S.C. 5318(i) and 31 C.F.R. 1010.610), suspicious activity reporting (31 U.S.C. 5318(g) and 31 C.F.R. 1020.320), and FinCEN's civil enforcement authority (31 U.S.C. 5321(a) and 31 C.F.R. 1010.810). It also refers to the rule that a customer's exemption from currency transaction reports does not remove the bank's duty to file SARs (31 C.F.R. 1020.315(h)).

The relevant period is stated as at least 1 January 2018 to 1 July 2025. The bank admitted the statement of facts and consented to the order.

The control failures FinCEN describes

Transaction monitoring and the Event Processor

FinCEN's findings centre on the bank's Event Processor transaction monitoring system. The order describes weaknesses in the way monitoring thresholds were set and in how alerts were grouped, suppressed and rescored. It records that in December 2023 the bank lowered the Event Processor threshold, discontinued rescoring logic and shortened the open period for event groups. The OCC adds that the bank's monitoring system was deficient and that it failed to properly monitor trillions of dollars in transactions, and that it knew for years that potentially suspicious activity was not being escalated to investigators without correcting the problem.

The lesson is that tuning is a control, not an afterthought. Thresholds, suppression rules and rescoring logic decide which activity a human ever sees, so each change needs a documented rationale, testing and sign-off. Our guide to the Metro Bank monitoring failure shows a similar pattern in the UK.

Independent testing and customer due diligence

The order finds that independent testing was ineffective and that there were customer due diligence weaknesses in customer risk profiles and ongoing monitoring. The OCC separately says the bank's audit function failed to identify long-standing BSA concerns that examiners later found. Independent testing only has value if it finds problems before the regulator does.

People, skills and training

The OCC says the BSA Officer and staff lacked sufficient skills and expertise, and that key BSA personnel were not adequately trained, which led to inaccurate and late SARs. This is a reminder that governance covers competence as well as policy. Regular, relevant training is part of a defensible programme.

Missed and late suspicious activity reports

FinCEN says more than $5 billion in suspicious activity was missed or reported late, with roughly $1 billion of it implicating national security or other priority illicit finance risks. Our suspicious activity reporting guide explains why timeliness matters: a SAR filed after the money has moved and the trail has gone cold has far less value to law enforcement.

Priority risks: Chinese money laundering networks and trade-based laundering

The order says hundreds of millions of dollars in transactions consistent with a Chinese money laundering network typology were not reported on time, including some linked to back-to-back credit card purchases, with SARs filed late. It also describes more than $600 million in transactions showing potential trade-based money laundering involving salvaged vehicles, about a third of which had a southwest border link. The OCC says the bank processed potential trade-based money laundering because of a systemic gap in its transaction monitoring.

If these typologies are new to you, read our guides to Chinese money laundering networks and FinCEN advisory FIN-2025-A003, which set out the red flags that regulators expect firms to monitor.

Sanctions: the OFAC settlement

The OFAC settlement is separate from the AML penalty, but it sits in the same story. FinCEN's release identifies apparent violations across several sanctions programmes. We could not read OFAC's own enforcement notice for this article, so we do not repeat figures that appear only in secondary press coverage. Check OFAC's published settlement notice for the detail of the transactions, the penalty calculation and the compliance commitments.

Remediation and what comes next

FinCEN's release says the bank must take remedial action. Press coverage reports requirements for a third-party lookback to identify previously undetected suspicious transactions and independent reviews of AML governance, but we could not confirm the full list of undertakings, deadlines or monitoring terms from the documents we could read. The order also notes that remediation began after engagement with prudential regulators and after FinCEN's investigation started, and the bank has said it is working to address the issues raised by its regulators.

Practical lessons for compliance teams

• Treat monitoring changes as controlled changes. Record why thresholds, suppression rules and rescoring logic change, test the effect and keep the evidence.
• Escalation must work in practice. A rule that generates an alert is not enough if the alert never reaches an investigator.
• File SARs on time. Track the time from detection to filing and report the late ones to senior management.
• Map your own priority risks. Regulators now name specific typologies such as Chinese money laundering networks and trade-based laundering. Show how your monitoring covers them.
• Make audit independent and effective. Testing should find the gaps before an examiner does.
• Invest in people. Skills, training and clear ownership for the BSA officer role are part of the programme.

Frequently asked questions

How much was Bank of America fined?

FinCEN assessed about $1.2 billion, crediting the OCC's separate $750 million penalty. OFAC announced an $11.6 million settlement. Always quote the amount for the specific agency.

Which laws did FinCEN rely on?

The Bank Secrecy Act provisions on AML programmes, correspondent account due diligence and suspicious activity reporting, enforced under FinCEN's civil penalty authority.

What period does the order cover?

At least 1 January 2018 to 1 July 2025, according to the consent order.

Does this affect firms outside the United States?

The order applies to a US bank, but the failures it describes, such as weak monitoring tuning, late reporting and ineffective testing, are the same ones UK, Irish and EU supervisors act on. It is a useful case study for any compliance team.

What we could not confirm

We read the FinCEN release, consent order and OCC release through a summarising tool, and the consent order text was truncated. We could not confirm the exact signing date of the order, the terms of the undertakings or any cooperation credit, and we did not read OFAC's own notice. Please check all figures against the original agency documents before relying on them.

For more enforcement lessons, browse the rest of our AML and KYC guides.