In one of the largest financial enforcement actions in federal history, the U.S. Department of the Treasury, alongside key banking regulators, announced an enforcement penalty exceeding $1.21 billion against Bank of America. The action follows multi-year federal investigations revealing systematic deficiencies in Bank of America's Bank Secrecy Act (BSA), Anti-Money Laundering (AML), and Office of Foreign Assets Control (OFAC) sanctions compliance frameworks. Regulators revealed that the bank failed to report over $5 billion in suspicious transactions to the Financial Crimes Enforcement Network (FinCEN), with more than $1 billion tied directly to national security priorities and illicit finance risks. According to the U.S. Treasury Department's official press release, the coordinated action spans three primary divisions of the federal financial regulatory architecture.
Breakdown of the $1.21 Billion Treasury Penalty
The $1.21 billion total penalty represents a coordinated multi-agency action spanning three primary divisions within the federal financial regulatory architecture. The Financial Crimes Enforcement Network, or FinCEN, imposed a $450 million penalty targeting BSA and AML monitoring gaps and delayed Suspicious Activity Reports. The Office of the Comptroller of the Currency, or OCC, imposed a $750 million penalty focused on ineffective corporate governance and inadequate compliance resources. The Office of Foreign Assets Control, or OFAC, reached a settlement action addressing sanctions processing failures involving high-risk jurisdictions. This multi-agency structure reflects how seriously regulators view the intersection of compliance failures and national security risk. For context on how regulatory enforcement shapes bank balance sheets, the Deposit Flight vs. Digital Dollars article covers how banks navigate an increasingly complex regulatory environment.
Core Findings | Deferred Audits and Outsourced Control Failures
According to enforcement documents released by Treasury, Bank of America prioritized revenue growth over compliance infrastructure. Key operational breakdowns cited by federal auditors include outsourced compliance auditing, where the bank relied excessively on external law enforcement inquiries and third-party notices to flag illegal transactions rather than maintaining robust automated internal monitoring systems. The bank also failed to report suspicious capital flows, with over $5 billion in transactions going unreported due to systemic backlog delays. FinCEN explicitly highlighted illicit capital channels linked to Chinese money laundering networks, Mexican cartels along the U.S. Southwest border, and sanctioned entities tied to Iran and Russia. Additionally, foreign correspondent account failures meant Customer Due Diligence programs failed to detect trade-based money laundering schemes operating through foreign correspondent accounts. According to AP News' reporting on the fine, the scale of unreported activity represents one of the most significant AML compliance failures documented by federal regulators in recent years.
Mandated Remediation and Independent Lookback Order
In addition to financial penalties, the Treasury Consent Order imposes strict operational mandates on Bank of America. First, a mandatory third-party transaction lookback requires the bank to retain an independent auditing firm to re-examine historical transaction records and file retroactive Suspicious Activity Reports on unflagged activity. Second, an independent data governance audit means regulators require a comprehensive review of the bank's data governance architecture supporting AML controls. Third, high-risk corridor re-certification requires the bank to undergo external evaluation focusing specifically on compliance with Southwest border narcotics tracking, Iranian sanctions, and Russian trade embargoes. According to Banking Dive's industry analysis, the mandated lookback and independent audit requirements represent a significant ongoing operational and financial burden for the bank beyond the immediate penalty.