OFAC Bank of America $11.66 Million Settlement: Sanctions Screening Lessons

On 13 October 2026 the US Office of Foreign Assets Control (OFAC) announced an $11,662,930 settlement with Bank of America, N.A. for 475 apparent violations of US sanctions. It was announced on the same day as FinCEN's and the Office of the Comptroller of the Currency's much larger anti-money laundering (AML) penalties against the bank. OFAC classed the violations as non-egregious and mostly not voluntarily disclosed. The settlement is small next to the AML penalties, but the facts are an unusually clear list of the ways a sanctions screening programme fails in practice: vendor data, filter updates, alert prioritisation and human error. To build your sanctions knowledge, see our CPD courses.

This guide is based on OFAC's enforcement release and settlement page. We read them through a summarising tool, so check every figure against the release before you quote it.

The settlement in outline

OFAC identified 475 apparent violations of sanctions programmes covering Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism. The total transaction value was about $14,834,082, over a period from 18 September 2021 to 24 April 2025. OFAC found 413 violations were not voluntarily self-disclosed and 62 were. The base penalty equals the settlement amount: it is the sum of the schedule amount for each non-disclosed violation and one-half of the transaction value for each disclosed violation. There was no reduction. The release does not state a statutory maximum in the text we read.

What went wrong

Blocked banks in the payment routing directory

The largest group involved a routing directory supplied by a third-party vendor that included banks later blocked by OFAC. The bank processed 403 transactions totalling $14,340,100 through 35 blocked banks between February 2022 and March 2025. OFAC attributes this to delayed updates to screening filters, analyst errors and an alert suppression rule, and says the bank's initial lookback was narrow.

Exact name and date of birth matches treated as low priority

A design flaw classified alerts for exact matches on name and date of birth with blocked persons as low or medium priority. Three designated individuals completed 31 transactions totalling $56,258 between September 2021 and February 2024. The flaw was fixed in February 2024. An exact match on both name and date of birth is about as strong a hit as there is, so it is a striking failure of prioritisation. Our guide to sanctions screening and alert resolution explains how alert triage should work.

Watchlists updated late

A vendor error in 2023 delayed a watchlist update and led to six transactions totalling $100,828. A system failure in February 2025 led to 26 transactions totalling $146,543 for a designated ship management company.

Human error with blocked persons' accounts

An analyst wrongly dismissed an alert in 2023, leaving a blocked individual's business account open, and six transactions totalling $340 were processed. In 2025 staff moved $189,869 from restricted accounts to a new account; compliance blocked it before any transactions took place.

Why OFAC treated it as it did

Aggravating factors included reckless conduct, such as delayed screening fixes, a month-long watchlist gap, prolonged misprioritisation of alerts and inadequate analyst training; harm to the foreign policy goals of several sanctions programmes, since more than $14 million went to or through blocked banks mostly without being stopped; the bank's size and sophistication; and previous cautionary letters from OFAC about substantially similar conduct. A tolling agreement covered violations tied to one designated individual, but OFAC found no net reduction warranted. The release says no mitigation was applied for remedial measures or cooperation, and describes the bank's disclosures as piecemeal or incomplete and slow, which prolonged the investigation.

Compliance considerations OFAC highlights

• Effective programmes need detailed management oversight, risk identification across the organisation and durable fixes.
• Recurring similar violations can cast doubt on a programme's effectiveness.
• Alert parameters should be risk-based, supervised and regularly tested.
• Organisations remain responsible for vendor-supplied screening tools, and technical changes should be controlled to avoid backlogs.
• Front-line and customer-facing staff need training, supported by testing, auditing and clear escalation paths.
• Investigate promptly, find root causes, remediate thoroughly and self-disclose violations.

How it fits the wider picture

The same bank faced a $1.2 billion FinCEN penalty and a $750 million OCC penalty that day; see our Bank of America consent order guide. For the UK equivalent of screening data gaps and unscreened payment chains, read our guide to the OFSI Citibank penalty.

Practical steps for your own screening

• Test whether exact matches on strong identifiers always reach a senior analyst quickly.
• Check that vendor routing and bank directories are screened against current lists, and that someone owns the vendor relationship.
• Time how long a new designation takes to reach every screening filter.
• Review alert suppression rules for unintended effects.
• Make sure restricted accounts cannot be moved without a second check.

Frequently asked questions

How much was the OFAC settlement?

$11,662,930 for 475 apparent violations.

What does non-egregious mean?

OFAC distinguishes egregious from non-egregious cases when setting the base penalty. Non-egregious cases attract a lower base penalty.

Did the bank self-disclose?

Mostly not: 413 violations were not voluntarily self-disclosed and 62 were.

What we could not confirm

We read OFAC's release and settlement page through a summarising tool. The statutory maximum is not stated in the text we read, and we did not read the bank's own account of the case. Please check all figures against the release.