The US Treasury Department recently imposed $1.21 billion in penalties on Bank of America for anti-money laundering (AML) lapses and alleged sanctions violations. The Financial Crimes Enforcement Network (FinCEN) levied $1.2 billion, the Office of the Comptroller of the Currency (OCC) added $750 million (credited against FinCEN's penalty), and the Office of Foreign Assets Control (OFAC) settled for $11.6 million.
This isn't just a headline number. It's a clear message that AML and Bank Secrecy Act (BSA) compliance failures will cost you more than remediation budgets and consent orders.
What Happened
Bank of America, the second-largest bank in the US, failed to maintain adequate controls for detecting and reporting suspicious activity. The enforcement action involved three federal agencies, each addressing different compliance breakdowns within the same institution. FinCEN and the OCC focused on systemic AML and BSA deficiencies, while OFAC addressed sanctions screening failures.
The Treasury's press release emphasized that AML and BSA enforcement is a top priority. Expect more actions like this, not fewer.
Timeline
While the specific timeline of Bank of America's compliance failures hasn't been publicly detailed, the coordinated enforcement action itself highlights regulatory coordination. When three agencies announce penalties simultaneously, they've been comparing notes for months. Your regulators talk to each other, and they expect your compliance programs to address overlapping obligations coherently.
Which Controls Failed or Were Missing
The penalties point to failures across multiple control layers:
Transaction monitoring systems didn't flag suspicious activity adequately. This isn't about missing one transaction. It's about systematic gaps in your detection logic, tuning parameters, or coverage of high-risk scenarios.
Suspicious Activity Report (SAR) filing processes broke down. You're required to identify, investigate, and report suspicious activity within specific timeframes. If your case management workflow can't support timely decisions, you're exposed.
Sanctions screening failed to catch prohibited transactions. OFAC's involvement indicates that Bank of America processed transactions involving sanctioned parties or jurisdictions. Your screening tools need complete coverage of OFAC's Specially Designated Nationals (SDN) list, consolidated sanctions lists, and sectoral sanctions.
Governance and oversight didn't catch the deficiencies early. When penalties reach this scale, it means your board-level risk committees, compliance testing, and internal audit didn't surface the problems before regulators did.
What the Relevant Standard Requires
The Bank Secrecy Act requires financial institutions to establish and maintain effective AML programs with five minimum components:
- Internal policies, procedures, and controls tailored to your risk profile
- A designated BSA compliance officer with authority and resources
- Ongoing employee training on AML obligations and red flags
- Independent testing of your AML program (audit or third-party review)
- Customer due diligence that includes beneficial ownership identification
FinCEN's regulations at 31 CFR 1020.210 spell this out. You don't get credit for having a program on paper. It has to work.
OFAC's 31 CFR 501 requires you to block transactions and freeze assets involving sanctioned parties. Your compliance program must include risk-based screening, escalation procedures for potential matches, and recordkeeping that proves you checked.
The OCC's heightened standards for large banks (12 CFR 30, Appendix D) add requirements for board oversight, independent risk management, and internal audit coverage of BSA/AML compliance.
Lessons and Action Items for Your Team
Test your transaction monitoring system against known typologies. Don't wait for regulators to tell you your scenarios are stale. Run red team exercises quarterly: seed your system with transactions that should trigger alerts based on FinCEN advisories and typology guidance. If they don't alert, fix your rules.
Measure SAR decision quality, not just volume. Track how long investigations sit in your queue, what percentage of alerts result in SARs, and whether your narratives contain the five essential elements (who, what, when, where, why). If you're filing SARs just to clear alerts, you're not meeting the standard.
Audit your sanctions screening configuration monthly. OFAC updates the SDN list constantly. Your screening tool should ingest updates automatically, but verify it's happening. Check your match logic: are you screening all relevant fields (names, addresses, account numbers)? Are you documenting your disposition of potential matches?
Fix your governance reporting. Your board and senior management need metrics that matter: alert-to-SAR conversion rates, average investigation time, sanctions screening false positive rates, and testing results. If your AML report is just a compliance checkbox, you're not managing the risk.
Resource your second line properly. Compliance can't validate transaction monitoring rules, test sanctions screening, and oversee investigations if you've staffed it like an administrative function. Calculate your workload based on transaction volume, alert rates, and regulatory expectations, then staff accordingly.
Document your risk assessment methodology. FinCEN expects you to tailor your AML program to your specific risks: products, services, customers, and geographic footprint. If you can't show how your customer risk ratings drive enhanced due diligence decisions, or how your transaction monitoring scenarios reflect your actual risk exposure, you're vulnerable.
The $1.21 billion penalty against Bank of America isn't an outlier. It's a benchmark. Treasury's explicit statement that AML enforcement is a top priority means your program will be tested, and "we're working on it" won't satisfy the examiner standing in your office.
Your controls either work or they don't. Make sure you know which before your regulator does.
