The Office of the Comptroller of the Currency on Oct. 13 assessed a $750 million civil money penalty against Bank of America, N.A., for violations of the Bank Secrecy Act and its implementing regulations, including 12 CFR 21.21 and 12 CFR 21.11. The agency’s News Release 2026-89 says the amount “is the largest in OCC history.” It was one of three penalties against the bank announced the same day.
The Treasury Department packaged the OCC action with a $1.2 billion penalty from the Financial Crimes Enforcement Network and an $11.6 million settlement with the Office of Foreign Assets Control, for a total it put at “more than $1.21 billion.” Treasury says the actions include the third-largest penalty in its history. The size is only half the story. The bank has operated under a December 2024 cease-and-desist order on these same problems, and the OCC says it has not fixed them.
1. What the OCC found
The OCC’s findings are blunt. The bank’s transaction monitoring system left it “failing to properly monitor trillions of dollars in transactions,” which produced large numbers of late suspicious activity reports (SARs) involving billions of dollars. Many of those late SARs, the agency says, “had indicia of money laundering.” The bank “knew for years” that it was failing to escalate potentially suspicious activity to investigators and did not correct it.
The staffing findings go to the top of the program. The OCC says the bank’s BSA Officer and staff “lacked sufficient skills and expertise” to run it, key personnel were not properly trained in identifying and reporting suspicious activity, and the internal BSA audit function missed long-standing concerns that examiners later uncovered.
Then comes the part that turned a remediation case into a record penalty. After agreeing to the 2024 Order, the bank “did not complete many of the significant steps” needed for an effective program. More than a year after that order, it still failed to escalate suspicious activity for review, and a “systemic gap” in monitoring let it process potential trade-based money laundering transactions. Management, the OCC says, “continued to minimize the program’s significant deficiencies.”
The bank’s poor response to its BSA deficiencies is unacceptable. The second largest bank’s egregious and continued BSA violations warrant the OCC imposing its largest CMP ever assessed against a bank.
EXCERPT · Comptroller Jonathan V. Gould, OCC News Release 2026-89, Oct. 13, 2026
2. Three agencies, one bill
The actions are explicitly coordinated. The OCC says it acted “in coordination with an action by” FinCEN, whose $1.2 billion fine “credits the OCC’s $750 million penalty.” In other words, the two largest figures overlap rather than add up. Treasury’s total of more than $1.21 billion matches FinCEN’s $1.2 billion plus OFAC’s $11.6 million. The OCC penalty will be paid to the U.S. Treasury.
| Agency | Action | Amount | Core finding |
|---|---|---|---|
| OCC | Civil money penalty | $750 million | Deficient, ineffective BSA/AML program; 12 CFR 21.21 and 21.11 |
| FinCEN | Consent order and penalty | $1.2 billion (credits OCC’s $750 million) | Willful BSA violations; over $5 billion in suspicious transactions not timely reported |
| OFAC | Settlement agreement | $11.6 million | 475 apparent sanctions violations |
| Treasury total | More than $1.21 billion | Actions include the third-largest penalty in Treasury history |
FinCEN’s case goes further than the OCC’s. According to Treasury, Bank of America “admits that it willfully violated the BSA” by failing to maintain a compliant AML program, to conduct due diligence on correspondent accounts for foreign financial institutions, and to file SARs. Over $1 billion of the more than $5 billion in activity not timely reported implicated national security and other priority risks, including Chinese Money Laundering Networks, fraud and potential trade-based money laundering with “a substantial nexus to the southwest border.”
Treasury’s sharpest line concerns how the bank found suspicious activity at all. Its reliance on law enforcement inquiries and requests from other banks meant it “effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations,” while it “prioritized its revenues and minimized the impact on its required compliance resources.”
OFAC’s settlement covers 475 apparent violations across programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism. OFAC found them non-egregious and “largely not voluntarily self-disclosed,” and gave no reduction to the base penalty for remediation or cooperation.
3. What the bank must fix
The remedial requirements sit mostly in FinCEN’s consent order, as Treasury summarizes it:
- A lookback, conducted with a third party, to identify and report to FinCEN suspicious transactions that went undetected.
- An independent review of its suspicious activity monitoring, customer due diligence and foreign correspondent due diligence programs, plus the data governance behind its AML program.
- Reviews tailored to three priority risks: the southwest border, cartels and potential narcotics trafficking; Iran; and Russia.
Under the OFAC settlement, the bank made compliance commitments on training, testing and audit, and on future cooperation with OFAC. The December 2024 cease-and-desist order also remains in place. Neither press release states deadlines for the lookback or the independent reviews; those would be in the orders themselves.
4. What happens next
Neither release addresses the administration’s wider supervisory agenda, which gov.house has tracked through the Fed’s lighter Basel capital rewrite and the FDIC’s faster merger approvals. The more likely reading is that capital and merger rules are being eased while BSA enforcement is not. Gould’s warning that banks without effective programs “can expect swift and significant action” points the same way.
- The lookback: its results must be reported to FinCEN; no public date is given.
- The independent reviews: scoped to monitoring, due diligence and data governance, with no deadline in the releases.
- The 2024 Order: still in force, and the OCC’s yardstick for whether the bank’s next round of fixes counts.
gov.house is independent and is not affiliated with any government body. This file is journalism, not investment, tax or legal advice. How we work: ethics & standards · Spotted an error? Corrections.