On October 13, 2026, FinCEN imposed a $1.2 billion penalty on Bank of America for Bank Secrecy Act violations. The enforcement action, coordinated with the OCC and OFAC, wasn't due to a sophisticated breach. Instead, it stemmed from a fundamental issue: the bank failed to report more than $5 billion in suspicious transactions on time, including over $1 billion tied to national security and illicit-finance risks.
For risk leaders outside financial services, this case offers a clear lesson. The failure wasn't that suspicious activity occurred, but that identified weaknesses didn't consistently lead to corrective action.
What Happened
Bank of America's anti-money laundering (AML) program failed to effectively monitor transaction volumes, allowing potentially suspicious activity to go undetected or unresolved. According to the U.S. Treasury Department, the bank's compliance program couldn't consistently identify, investigate, escalate, and report suspicious transactions within required timeframes.
Regulators found the bank relied heavily on external inquiries from law enforcement and other financial institutions to flag activity its own monitoring should have caught. The monitoring infrastructure was in place, but the connection between detection and action broke down.
Timeline
The enforcement order doesn't specify the exact duration of the failures, but it describes a sustained pattern: suspicious activity accumulated without timely investigation or reporting over an extended period. The coordinated regulatory response from FinCEN, OCC, and OFAC indicates the scope extended across multiple compliance obligations and risk categories.
The consent order now requires independent reviews of key AML program elements, suggesting regulators determined internal oversight mechanisms were insufficient to identify and correct the deficiencies before external intervention.
Which Controls Failed
Three control layers broke down:
Transaction Monitoring Controls
The bank's systems failed to consistently detect suspicious patterns across enormous transaction volumes. Monitoring existed, but it didn't reliably surface activity requiring investigation.
Escalation and Investigation Protocols
When suspicious activity was flagged, it didn't consistently reach the right decision-makers within appropriate timeframes. The bank's processes for investigating and resolving alerts failed to function as designed.
Independent Verification Mechanisms
Internal oversight didn't catch the accumulating deficiencies before regulators intervened. The organization's second and third line functions didn't effectively challenge whether first line safeguards were operating as intended.
What the Standards Require
The Bank Secrecy Act requires financial institutions to establish AML programs reasonably designed to detect and report suspicious transactions. But the regulatory expectation extends beyond documentation. The program must actually work.
This maps to broader control requirements across industries:
COSO Internal Control-Integrated Framework requires organizations to establish monitoring activities that assess whether internal controls are present and functioning. Simply performing a monitoring activity doesn't satisfy the principle. The monitoring must produce evidence that controls operate effectively.
AS 2201 establishes that auditors evaluating internal control over financial reporting must obtain evidence about operating effectiveness, not just design. A control documented in a policy manual may fail when executed.
The Three Lines Model clarifies that operational ownership (first line), risk oversight (second line), and independent assurance (third line) must coordinate without blurring accountability. When these lines collapse or fail to communicate effectively, control weaknesses can persist undetected.
Bank of America's case demonstrates what happens when these requirements remain theoretical rather than operational.
Lessons and Action Items
1. Test operating effectiveness, not just existence.
Schedule regular testing of critical monitoring controls. When testing identifies a weakness, document the finding, assign it to an accountable owner, track the corrective action, and verify the fix works before closing the issue. Don't assume that completing a remediation task means the underlying control now operates correctly.
2. Map every critical alert to a decision-maker.
Review your escalation procedures. For each type of significant warning sign, exception, or control failure, identify who receives the alert, who investigates, who decides on the response, and what timeline applies. If you can't trace a critical alert from detection through resolution, you have a gap.
3. Separate execution from verification.
Apply the Three Lines Model to your most critical safeguards. The team executing a control shouldn't be the same team verifying it works. For material risks, independent reviewers must have sufficient authority to challenge operating effectiveness without being responsible for the outcome.
4. Connect monitoring outputs to business impact.
Your board and executive team need visibility into more than compliance status. They need to understand which safeguards are working, where weaknesses exist, what business outcomes may be affected, and whether corrective actions are progressing. Report controls that haven't been tested, failed tests, overdue remediation, and fixes awaiting verification separately so leadership can see where decisions are needed.
5. Verify remediation independently.
Before you mark a material finding as resolved, verify the fix. Use a reviewer independent of the work. Make the verification depth proportionate to the risk. Closing an issue without evidence that the safeguard now operates as intended creates false assurance.
6. Establish escalation triggers, not judgment calls.
Don't rely on individuals to independently recognize when an issue is significant enough to escalate. Define the triggers, timelines, and decision-making responsibilities in advance. Critical issues shouldn't depend on someone's judgment about whether to raise concerns.
The Bank of America enforcement action demonstrates a gap that can emerge gradually: monitoring exists but doesn't connect to accountability, escalation procedures are documented but not consistently followed, and remediation is recorded but not independently verified.
If one of your critical safeguards stopped working today, could you trace the failure to an accountable decision-maker, corrective action, and evidence that the fix works? That's the question every risk leader should be able to answer.
