Bank of America’s $1.2 Billion Fine Follows a 2024 Order

Three U.S. agencies fined Bank of America more than $1.21 billion on Oct. 13 for anti-money-laundering and sanctions failures the bank had already been ordered to fix in 2024. FinCEN’s $1.2 billion penalty, the third largest in Treasury history, credits a record $750 million OCC fine and sits beside an $11.6 million OFAC settlement.

The cash is a one-quarter charge. The open 2024 cease-and-desist order is the longer problem, because examiners say the second-largest U.S. bank still had not built a working watch on trillions of dollars in flows.

Today, the U.S. Department of the Treasury announced enforcement actions imposing more than $1.21 billion in penalties against Bank of America for violations of anti-money laundering and sanctions laws. These actions represent the third-largest penalty in Treasury history and the…

— Treasury Department (@USTreasury) October 13, 2026

The 2024 Order Came With No Fine

On Dec. 23, 2024, the Office of the Comptroller of the Currency issued cease-and-desist order AA-ENF-2024-56 against Bank of America, N.A. The order cited late suspicious activity reports, a customer due diligence gap the bank had already been told to fix, and weak internal controls, testing, and training. It required an independent consultant and lookback reviews. It imposed no civil money penalty.

Bank of America neither admitted nor denied those 2024 findings. A spokesperson later tied the Oct. 13, 2026 resolutions to “violations cited in the previously reported 2024 OCC Consent Order and FinCEN’s investigation.” Comptroller of the Currency Jonathan V. Gould treated that earlier paper as a promise the bank did not keep.

Almost two years ago, the bank signed an order with the OCC and committed to fixing its longstanding BSA deficiencies. Despite its obligation to the American people as a national-chartered, global systemically important bank, the bank’s BSA/AML compliance program continues to reflect widespread breakdowns in internal controls, which threatens U.S. national and economic security. The bank’s poor response to its BSA deficiencies is unacceptable.

Jonathan V. Gould, Comptroller of the Currency, OCC news release

The 2026 consent order, AA-ENF-2026-41, says the bank has begun corrective work and has hired thousands of new investigators as it rebuilds monitoring. It also says the program “remains deficient” and that management “continued to minimize” the gaps. The OCC reserved the right to assess more penalties if the same violations continue.

THE PATH FROM WARNING TO BILL

1. 2019 to 2023: Bank management, including the then-BSA officer, received written reports that the bank was missing SARs on about 18% to 44% of potentially suspicious activity that was never sent to investigators, depending on the year.
2. April 2024: The bank self-identified inaccurate transmittor names on outgoing wires, a Travel Rule failure it then stopped.
3. December 23, 2024: The OCC issues a cease-and-desist order with no money penalty and orders a consultant-led lookback.
4. 2024: The backlog of cases waiting for investigators peaks at nearly 200,000.
5. October 13, 2026: FinCEN, the OCC, and OFAC announce more than $1.21 billion in penalties, and FinCEN requires a fresh third-party lookback.

Gould called Bank of America the second-largest bank in the United States and the sixth-largest in the world, a firm that processes hundreds of trillions of dollars a year through about 3,500 branches, 15,000 ATMs, and operations in more than 35 countries. That scale is why a no-fine order in 2024 was never going to be the last word if the alerts stayed stuck.

Examiners Found Alerts That Never Reached Investigators

The 2026 OCC order, which the bank again neither admits nor denies, is blunt about the plumbing. Since at least 2019 the bank failed to monitor trillions of dollars properly, producing missed, late, inaccurate, and incomplete SARs on billions of dollars of activity, some with signs of money laundering. The bank knew for years it was not sending potential cases to investigators and did not correct that, the OCC said.

More than a year after the 2024 order, the bank still failed to escalate alerts for review, the largest civil money penalty in OCC history release states. A systemic gap in transaction monitoring also let through potential trade-based money laundering. The BSA officer and staff lacked the skill and training to run the program, key people were not trained on how to spot and report suspicion, and Corporate Audit missed problems examiners later found.

WHERE THE MONITORING BROKE

• Unreferred alerts: Written reports to management from 2019 through 2023 showed the bank failed to file SARs on 18% to 44% of potentially suspicious activity that never went to investigators.
• High-risk deposits: Negotiable-instrument deposits into high-risk accounts with trade-based money-laundering flags went poorly watched, and the bank failed to review that risk for at least two more years after the OCC raised it.
• Credit cards: Examiners found a systemic gap in a $102 billion card portfolio; in a sample of 10 accounts they flagged potential trade-based money laundering, and after the OCC asked, the bank filed SARs on hundreds of millions of dollars in half of those accounts.
• Foreign affiliates: Until August 2024 the bank used “simplified customer due diligence” on correspondent accounts for its own foreign branches and affiliates, which the OCC said was too thin for the risk.
• Wire names: From November 2021 through October 2024 the bank sent about 33,300 outgoing wires, totaling about $1 billion, with inaccurate transmittor names, a separate Travel Rule break from the national-security SAR total below.

The card sample is the clearest picture of the habit. Absent the OCC’s request, the order says, there is no sign the bank would have reviewed those accounts or filed those SARs. The detection work kept arriving from outside the bank’s own models.

More Than $5 Billion in Suspicious Activity Went Unreported

FinCEN’s case is the one Bank of America did admit. In the resolution the bank admits it willfully violated the BSA by failing to keep a minimum anti-money-laundering program, failing to run due diligence on correspondent accounts for foreign banks, and failing to file suspicious activity reports.

Treasury said the core breakdowns sat in how the bank found and reported suspicion and how it knew its customers. As those issues piled up, “Bank of America prioritized its revenues and minimized the impact on its required compliance resources.” The bank leaned on law-enforcement inquiries, requests from other banks, and similar outside prompts instead of its own automated controls, which Treasury described as outsourcing a large share of its duty to detect. Suspicious activity was allowed to sit uninvestigated until late reports of limited use to investigators.

Customer due diligence also failed to account for heavy payments from unknown third parties. Compliance staff escalated concerns about possible trade-based money laundering and fraud, including possible narcotics proceeds, and the bank still did not respond in time, Treasury said.

Those failures meant the bank did not timely report to FinCEN over $5 billion in suspicious transactions. Over $1 billion of that slice involved national-security and other priority risks, including activity indicative of Chinese money-laundering networks, fraud, and potential trade-based money laundering tied to the southwest border.

FinCEN’s new consent order requires a third-party lookback to find and report activity the bank missed, plus an independent review of suspicious-activity monitoring, customer due diligence, foreign-correspondent due diligence, and the data used in the AML program. Those reviews are aimed at southwest-border, cartel, and narcotics risk, and at Iran and Russia.

A Bank of America spokesperson said financial crime compliance “is serious, and we are responsible for getting it right,” and that the bank has “invested billions of dollars in technology and dedicated thousands of employees to combat financial crime.” The same statement said the team is “far along with and committed to completing the work required.” Treasury’s file is that testing had already shown the program was not identifying or reporting suspicion on time, and that outside referrals were doing too much of the job.

How the $1.21 Billion Penalty Is Built

The headline number is easy to misread. FinCEN assessed $1.2 billion. The OCC assessed $750 million. OFAC settled for $11.6 million. Add those three face amounts and you get about $1.96 billion. That is not what the bank will pay.

The OCC said FinCEN’s $1.2 billion fine credits the $750 million OCC penalty. The OCC amount is paid to the U.S. Treasury. OFAC’s settlement sits on top. Treasury’s package is therefore more than $1.21 billion in penalties, not a stacked $1.96 billion.

THE THREE AGENCY BILLS

Treasury called the action the third-largest penalty in its history. FinCEN’s October 2024 assessment against TD Bank was $1.3 billion, and that case came with a guilty plea, a four-year monitor, and an OCC asset cap. This Bank of America package, as announced, is FinCEN, the OCC, and OFAC. No Justice Department penalty was part of the Oct. 13 releases.

Secretary Scott Bessent said financial institutions “are on the front lines of protecting our economic and national security,” and that when a bank of this size fails, “the consequences extend far beyond its own walls.” He added that the actions “send a clear message that even the biggest financial institutions are not above the law.”

OFAC Settled 475 Apparent Sanctions Hits

The sanctions piece is smaller money and a different legal posture. OFAC announced an $11.6 million settlement for 475 apparent violations of sanctions programs on Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. The window ran from Sept. 18, 2021, through April 24, 2025. OFAC found the case non-egregious but largely not voluntarily self-disclosed: 413 of the 475 hits were not self-disclosed, and 62 were. The settlement took no cut from the base penalty for fixes or cooperation.

HOW THE SANCTIONS BREAKS HAPPENED

• Blocked banks: Correspondent payments were channeled through blocked banks because of technical and human error.
• Alert ranking: Exact name and date-of-birth matches to blocked persons were not given the priority they required.
• Watchlists: Lists were not updated promptly after OFAC designations.
• Two accounts: Business accounts tied to blocked persons were mishandled through human error.

Treasury said those failures let the bank process millions of dollars in apparent violation of the programs. As part of the settlement, Bank of America made commitments on training, testing, audit, and future contact with OFAC. The dollar figure is a rounding error next to FinCEN’s bill. The pattern is the same one in the BSA file: lists, alerts, and people did not catch up with the traffic.

A $1.2 Billion Charge Hits Third-Quarter Earnings

Bank of America said third-quarter results, due Oct. 14, 2026, will include a non-tax-deductible charge of $1.2 billion, cutting net income by about 17 cents a share. The spokesperson said substantial staff and other costs for the cleanup are already in the expense base. Shares of BAC closed at $53.96 on Oct. 13, down $0.62, or 1.14%.

For scale, the bank reported $9.07 billion of net income in the quarter ended June 30, 2026. A $1.2 billion civil bill is a real earnings event. It is not a capital event of the kind that came with TD Bank’s 2024 guilty plea and asset cap. The constraint that lasts is the 2024 cease-and-desist order, still in force, plus FinCEN’s lookback and the OCC’s warning that more civil money penalties remain available if the same breaks continue.

The louder public argument treated the fine as a one-day raid on a household name. The OCC’s own chronology starts in 2019, runs through a no-fine order in 2024, and lands in 2026 with the same escalation failure still open. Other banks that sent the inquiries Treasury described were, in practice, doing detection work Bank of America’s models were supposed to do. The lookback will now pull some of that missed activity into SARs after the fact, which is useful to investigators and a standing reminder that a consent order with no check attached is still an order.

Frequently Asked Questions

Why Is the Total $1.21 Billion Instead of $1.96 Billion?

FinCEN’s $1.2 billion assessment credits the OCC’s $750 million civil money penalty, and that OCC amount is paid to the U.S. Treasury, so Bank of America does not write a full $1.2 billion check and a separate $750 million check for the same BSA case. OFAC’s $11.6 million settlement is the only amount added on top, which is why Treasury described the package as more than $1.21 billion.

Did Bank of America Admit the Violations?

The bank admitted to FinCEN that it willfully violated the Bank Secrecy Act, including the duty to keep an AML program, run correspondent due diligence, and file SARs. It neither admitted nor denied the OCC’s 2026 findings, matching the posture it took on the Dec. 23, 2024 cease-and-desist order, which also used a neither-admit-nor-deny formula and carried no fine.

What Did the December 2024 OCC Order Require?

Order AA-ENF-2024-56 required Bank of America to strengthen its BSA/AML and sanctions programs, hire an independent consultant to assess those programs, and run lookback reviews so suspicious activity was reported. It named late SAR filing and an uncorrected customer due diligence gap, and it imposed no civil money penalty and no asset cap.

How Does This Rank Against the TD Bank Penalty?

FinCEN’s $1.3 billion assessment against TD Bank on Oct. 10, 2024, remains larger than this $1.2 billion FinCEN bill and was then described as the largest FinCEN penalty against a depository institution. TD’s global resolution also included a Justice Department guilty plea, a four-year independent monitor, and an OCC cap on U.S. retail growth, none of which appear in the Bank of America releases dated Oct. 13, 2026.

The lookback FinCEN ordered will now try to recover SARs the models missed. Gould’s office has already said another civil money penalty is on the table if the same breaks are still there when examiners come back.

Disclaimer: This article is news reporting on announced regulatory penalties and related company statements. It is for information only and is not legal, investment, tax, or compliance advice. It does not tell readers whether to buy, sell, or hold Bank of America securities, how to treat the charge on a tax return, or how any other bank should design an AML program. Consult a licensed attorney, a qualified investment adviser, and a tax professional before acting on any of these facts. Penalty amounts, consent-order duties, and the bank’s earnings impact reflect the agency releases and the company’s statement as of Oct. 13, 2026, and those figures and duties can change if further orders are issued.