Compliance failures at Bank of America led the US Treasury to announce more than $1.2 billion in penalties on October 13, 2026, covering anti-money laundering and sanctions violations, as AP reported. Three agencies acted. Each one examined a different control.
Plenty of businesses outside banking run versions of these compliance controls, since anyone who screens customers or moves money does. This post covers what regulators found, what the bank must do next, which businesses have to follow OFAC sanctions, and how to audit your own controls on Monday morning.
What was Bank of America fined for?
Regulators say the bank filed suspicious transaction reports late or left them out, and that it committed 475 apparent sanctions violations.
- The Financial Crimes Enforcement Network (FinCEN) assessed $1.2 billion. It found that the bank filed more than $5 billion in suspicious transactions late or left them unreported, and that more than $1 billion of that activity carried national security or other priority risks. Treasury tied part of it to Chinese money laundering networks, fraud, and possible trade-based money laundering near the southwest border. The weak spots sat in two places: spotting and reporting suspicious transactions, and knowing the customer behind the account. Treasury also said the bank handed a large share of its detection and reporting work to third parties.
- The Office of the Comptroller of the Currency (OCC) assessed a penalty of $750 million. This is the largest fine ever imposed by OCC. In addition, the OCC will count the penalty toward FinCEN’s total assessment of $1.2 billion.
- The Office of Foreign Assets Control (OFAC) agreed to settle charges related to 475 apparent violations of sanctions programs regarding Iran, Russia, narcotics, and international terrorist organizations. As part of the settlement, OFAC has required the bank to implement procedures for employee training, testing, auditing, and maintaining communication with OFAC officials. When combined with FinCEN’s $1.2 billion in penalties, OFAC’s $11.6 million represents an additional $11.6 million in penalties, bringing the total amount of penalties assessed against the bank to $1.21 billion.
This $1.21 billion fine represents the third-largest fine ever levied by FINCEN. It trails both Binance ($3.4 billion, 2023) and TD Bank ($1.3 billion, 2024), both of which included accompanying monetary penalties imposed by the U.S. Department of Justice.
Why do transaction monitoring and sanctions screening fail in different ways?
Transaction monitoring uses software rules to flag unusual account activity, and sanctions screening checks customers and the people and companies on a payment against government lists of banned parties. Monitoring fails when work moves slowly, and screening fails when the list is old.
A monitoring alert sits in a queue. Then the case waits for a reviewer, and the report waits for a filer, so every step adds days. Screening depends on lists instead. A list updated three weeks ago misses a name a government added yesterday, and a list that skips a country misses every name from it, which is why weekly sanctions list updates matter to a screening team.
Alerts closed per month tell you how busy the team is. FinCEN’s finding is about elapsed time, which needs its own measure. Track the age of your oldest open alert for monitoring and the last update date of each list for screening, and one spreadsheet answers both questions. The audit below uses those two numbers.
Also Read – Criminal History Check vs Warrants Search: What Sets Them Apart?
What happens to Bank of America after the penalty?
The bank must hire an independent third party to review past transactions, find suspicious activity it missed, and report it to FinCEN, as part of a consent order, Reuters reports. A consent order is a binding agreement between a bank and its regulator that lists the fixes the bank must make.
Bank of America told analysts the order leaves out an asset cap, the limit on how large a bank can grow that regulators placed on TD Bank in 2024. The bank also said it has completed much of the required work and moved about 1,000 employees from other units to fix the problems.
Comptroller of the Currency Jonathan Gould described the history differently. He pointed out that the bank committed to fixing its Bank Secrecy Act problems almost two years ago and said its program still showed widespread breakdowns in internal controls, Banking Dive reports.
American Express took a $350 million penalty from federal regulators less than a week earlier, over similar failures to detect and report suspected money laundering, Axios reports.
Which businesses must follow OFAC sanctions and screen their customers?
Every US person must follow OFAC sanctions, and that covers far more than banks. OFAC’s own FAQ names US citizens and permanent residents wherever they live, anyone inside the United States, and US-incorporated companies along with their foreign branches, and certain sanctions programs reach foreign subsidiaries of US companies too (OFAC FAQ 11). Companies outside the US face limits as well, since sanctions bar them from causing a US person to break the rules or from evading them.
Screening is the everyday way a business stays inside those rules. OFAC can apply civil penalties even when a violation was accidental, and its compliance framework expects a risk-based program built on five parts: management commitment, risk assessment, internal controls, testing and auditing, and training. A screening source with coverage across more than 180 countries helps when your customers or partners operate abroad.
A separate law covers money laundering. The Bank Secrecy Act is the US law that requires banks and other defined financial firms, such as broker-dealers and money services businesses, to run anti-money laundering programs and file suspicious activity reports. A business outside those groups still follows OFAC sanctions but may face different reporting duties, and a lawyer can confirm where your firm falls.
How can a compliance team check its own controls on Monday morning?
- How old is your oldest open alert?
Export the alert queue, sort by creation date, and read the top entry. An old alert can point to a staffing gap or confusion over who decides next, so ask the reviewer what it’s waiting for. Your compliance officer owns this answer. - How long did your last suspicious activity report take?
Take your most recent case and write down the time at each step, from first alert to filed report. The longest gap between two times is where to fix things first, and the case reviewer can tell you what happened during that wait. - Does your screening tool catch the names it should catch?
Take a short list of current names from OFAC’s public sanctions list, add two spelling variants of each (names written in other alphabets often have several valid spellings), and run them through the tool. Every name should raise an alert. If a name gets missed, either the tool’s name matching needs adjusting or the list behind it lacks the entry, and the second cause calls for a broader source such as sanctions records from many countries and international bodies. Your screening administrator can run this check in about an hour. - When was each list last updated?
Write down the last update date for every sanctions, PEP, and criminal record source. Today’s date minus that update date shows how stale today’s screening results can be, and a three-week-old list means three-week-old answers. Stamp each screening decision with the list version and date as well, so you can show what the tool knew when it decided.
Then re-screen existing customers after each update. Onboarding checked one day, and people take on public roles later, which is where PEP records for customer re-checks help. The data owner answers this one. - Who owns each outsourced task?
List every detection, review, or filing task a vendor handles, and name one person inside your company who reviews that vendor’s output. Treasury listed outsourcing among its findings, so a named owner for each task is the simplest fix. The head of compliance can sign off.
Also Read – 10 PEP Categories and Roles You Should Know
Which screening database fits each result from the audit?
Sanctions Database sells three separate databases, covers more than 180 countries, and refreshes its data weekly. You pick the one that matches your weakest result, and you can see how the three databases differ first.
- Missed names or old update dates call for the Global Sanctions List, which holds more than 3.55 million records of sanctioned people and companies. The page includes sample records from the Global Sanctions List so you can see the format before you decide.
- If customer re-screens lag behind role changes, look at the PEP List. It has more than 9.44 million records of people in prominent public positions, and it supports the customer due diligence step FinCEN cited. The page shares details of the PEP List along with a sample.
- Some teams also want to know whether a customer appears in warrant or criminal records. The Warrants & Criminal Entities List covers that with more than 6.67 million records, and its page explains the warrant and criminal record coverage before you decide.
Want to work with live data? The pricing page offers an API trial with 25,000 monthly records for three months on Enhanced API Access (full API integration required), plus 3,000 monthly records on Starter Access. Data answers the screening questions, while alert age and filing speed depend on your own process.
What should your compliance team do this week?
If that check involves old lists or missed names, look at the record format in a sample from Sanctions Database’s compliance data and use the API trial to check whether its records cover the names your tool missed. You’ll know by the end of the day whether the cause sits in your tool or in your data.
Also Read – Sanctions Screening False Positives: Causes, Risks, and Solutions
Frequently Asked Questions
Did Bank of America admit wrongdoing?
In the FinCEN consent order, the bank admitted willful violations of the Bank Secrecy Act, FinCEN said, according to Banking Dive. The OFAC settlement covers 475 apparent violations, a term OFAC uses for conduct that its review says breached sanctions rules.
What is a suspicious activity report?
A suspicious activity report, or SAR, is a filing that a financial institution sends to FinCEN when transactions look connected to money laundering, fraud, or other financial crime. Analysts decide whether an alert meets the filing standard, and the institution files within the deadline the regulation sets.
What is customer due diligence?
It means confirming who a customer is, understanding what that customer does, and judging the risk the account carries. FinCEN’s findings place it next to suspicious activity reporting, and politically exposed person checks form one common part of it.
What is trade-based money laundering?
It moves illicit value through trade transactions, for example by misstating the price, quantity, or description of goods on invoices. Treasury linked possible activity of this kind near the southwest border to part of the transactions Bank of America failed to report on time.
How often should a compliance team re-screen customers?
Set the interval by customer risk and write it into your compliance program. Your lists’ update cycle makes a useful starting point: with weekly refreshed screening databases, a weekly re-screen of existing customers means a newly added name reaches your records within days.