On October 13, three regulators announced coordinated actions against Bank of America. FinCEN assessed a $1.2 billion civil penalty in a consent order where the bank admitted to willfully violating the Bank Secrecy Act. This case is worth examining because the bank had a compliance function that, according to FinCEN, did much of its job. The failure occurred in the link between detection and decision-making.
The Challenge
The order found that the bank failed to maintain an adequate AML program, file suspicious activity reports, and address national security risks tied to Chinese money laundering networks and illicit finance along the southwest border. The OCC imposed a $750 million penalty for the same deficiencies, credited against FinCEN's. OFAC added an $11.6 million settlement for apparent violations of sanctions programs covering Iran, Russia, narcotics trafficking, and terrorism. The violations stretched from 2018 into 2025.
Regulators didn't penalize the absence of policies. They penalized the gap between what the bank knew and what it did.
Environment and Constraints
Two pressures shaped the outcome. The first was commercial. In July 2022, compliance personnel identified that a customer relationship, an online auto auction business, carried too much risk with no evident way to control it. They recommended closing the accounts. The relationship team argued the client was important, citing about $6 million in annual revenue.
The second was organizational. Internal testing repeatedly showed the bank's primary monitoring system was missing suspicious activity. Compliance could see the problem, but seeing requires access, and acting requires authority. When business leaders can overrule or bypass compliance without consequence, the function's warnings carry no weight.
Approach Taken
The bank chose mitigation over closure. A mitigation plan replaced the recommended account closure, and the customer continued processing payments until June 2025. Investigators documented well over a hundred cases tied to that single customer.
A second decision compounded the first. When a test of the monitoring system produced a result senior leadership did not like, the head of financial crimes had the test repeated. The second test declared the system was "working as intended." FinCEN disagreed.
Consider this as a decision pattern, not a villain story. Each choice looks defensible in isolation: keep an important client with added controls, rerun a test that might have been flawed. The pattern only becomes damning in sequence, which is why you need documented escalation paths. If a retest can replace an unfavorable result without independent review, your testing program is advisory at best.
Results and Metrics
The costs, as reported:
- Penalties: $1.2 billion from FinCEN, with the OCC's $750 million credited against it, plus $11.6 million from OFAC. The bank has announced a $1.2 billion charge.
- Avoided spending: FinCEN concluded the bank likely saved hundreds of millions of dollars in compliance spending while the problems persisted.
- Remediation: Fixing the program is expected to require roughly 750 additional staff, plus 800 consultants for a one-time lookback.
- Lookback findings: The lookback alone turned up nearly 8,900 suspicious activity reports that should have been filed.
That $1.2 billion figure excludes the lookback, independent reviews, ongoing regulatory orders, management time, and reputational damage. Cost avoidance on compliance isn't savings. It's borrowing against the future at a punishing rate.
The same logic holds at a small scale. A 12-person freight forwarder, Pegasus Worldwide Logistics, paid $175,015 to OFAC over a $5,950 machine because its screening was late and looked only at a name. A better screening process would have cost a fraction of the penalty, the remediation program, and the continuing reporting obligations now imposed on the company.
What They Would Do Differently
You can't know what the bank's leaders would say, but the order points to several decision points that could have gone another way:
- Honor the closure recommendation. Compliance flagged the risk in 2022. Roughly $6 million in annual revenue was weighed against exposure that grew for years.
- Treat test results as findings, not negotiations. A failed monitoring test should trigger remediation of deficiencies, not a rerun until the answer improves.
- Give compliance a hard stop. The function needed authority to hold or stop a relationship when risk wasn't controlled, not just authority to recommend.
- Fund detection at the level of the risk. Shrinking the monitoring team reduces what the function can see.
Takeaways for Your Team
Don't read the FCPA pullback as reduced risk. Boards that infer lower enforcement risk from narrowed FCPA enforcement are confusing one statute with the broader landscape. June 2025 guidance narrowed foreign bribery priorities toward cartels, transnational criminal organizations, and national security. Meanwhile, the Justice Department established a National Fraud Enforcement Division in April, and its October 1 directive named four priorities: healthcare fraud, government procurement and contracts fraud, tax and revenue evasion, and trade fraud including tariff evasion and forced labor. These touch far more companies than the FCPA traditionally did. The directive also points to data analytics through a national fraud detection center and whistleblower incentives reaching even insiders who took part in the conduct. Cutting compliance now reduces your detection capability while the government's is increasing.
Make the budget case in leadership's language.
- Quantify exposure, not activity. Show what a customs misclassification, sanctions miss, or monitoring gap would cost at your scale, rather than training completion rates.
- Use the peer record. The Bank of America order is a documented case of what cost avoidance looks like, as the government itself characterized it.
- Offer the efficiency path. Automating and prioritizing by risk beats across-the-board cuts, provided it's validated.
- Set red lines. Name the functions that can't be cut without pushing risk past your Impact Tolerance, and ask leadership to accept that risk in writing if they proceed.
Test stature, not just structure. Having a CCO on the org chart proves little. Ask whether your compliance officers could stop a transaction if they needed to. Boards should ask a blunt question: over the past two years, how many times has compliance recommended against something, and what happened? "Never" signals compliance isn't being asked or heard. "Often, and the business overrode it" means the board should want to see every instance.
Count the costs beyond the fine. Investigation expense, monitorships, lost business, debarment risk, higher cost of capital, executive turnover, shareholder claims, and lost trust often exceed the penalty itself.
Bank of America's own people told it what was wrong in writing for years. Rebuilding a program after a failure costs more than maintaining one. Your job is to make sure leadership does that arithmetic before a regulator does it for them.
