Bank of America AML Penalty 2026: Key Facts
On 13 October 2026 the US Treasury announced about $1.21 billion in combined penalties against Bank of America for anti-money-laundering (AML) and sanctions failures.
- Who: Bank of America, described as the second-largest US bank. Penalties came from FinCEN, the OCC and OFAC.
- What: The bank admitted it willfully violated the Bank Secrecy Act.
- How much: FinCEN $1.2 billion (including credit for the OCC’s $750 million) plus an OFAC settlement of $11.6 million. Combined: about $1.21 billion.
- Why: More than $5 billion in suspicious transactions was reported late, and known gaps were not fixed after a 2024 order.
- Why it matters in India: The same controls (monitoring, STR filing, due diligence, sanctions checks) are tested under the PMLA, the PML Rules and the RBI KYC Directions.
Bank of America AML Penalty Timeline: 2023 Findings to October 2026
The penalty followed years of known problems, not a single event.
1. 2023: The OCC first identified significant deficiencies in the bank’s AML programme.
2. December 2024: The bank signed an OCC cease-and-desist order requiring it to fix its BSA/AML deficiencies.
3. After the order: Regulators found internal control breakdowns continued, including gaps that let possible trade-based money laundering go undetected.
4. 13 October 2026: Treasury, FinCEN, the OCC and OFAC announced the penalties, a day before the bank’s third-quarter earnings.
How Much Was Bank of America Fined? FinCEN, OCC and OFAC Penalties
The $1.2 billion is not one fine: the OCC amount sits inside the FinCEN amount, so the figures must not be added together.
| Agency | Amount | Note |
| FinCEN (Treasury) | $1.2 billion | Includes credit for the OCC penalty. Third-largest in Treasury history, per the Treasury release as reported |
| OCC | $750 million | Largest civil money penalty the OCC has imposed. Credited within the FinCEN amount |
| OFAC (Treasury) | $11.6 million | Settlement over 475 apparent sanctions violations |
| Combined | About $1.21 billion | OCC amount not counted twice |
Cost to the bank: A non-tax-deductible $1.2 billion charge in third-quarter results, reducing net income by about 17 cents per share. The bank’s shares fell about 2% in after-hours trading on the news.
Remediation required:
- A third-party review of suspicious transactions that went undetected.
- Independent reviews of the transaction-monitoring and customer due-diligence programmes.
What AML Failures Led to the Bank of America Penalty? Transaction Monitoring, STR Delays and Sanctions Gaps
Regulators described failures at every stage, from detecting suspicious activity to reporting it.
- Late reporting: More than $5 billion in suspicious transactions was not reported on time. More than $1 billion involved national security and other high-priority risks, including possible Chinese money-laundering networks and activity tied to the southwest border. The $5 billion figure reflects late reporting, not a finding that all of it was criminal.
- Monitoring gaps: The OCC said the transaction monitoring system failed to properly monitor trillions of dollars in transactions.
- Thresholds: The 2024 order cited a “systemic failure” to set appropriate thresholds for triggering investigations.
- Referrals: The bank knew for years that potentially suspicious transactions were not being referred for investigation and did not fix it.
- Outsourced detection: Treasury said the bank relied so heavily on law-enforcement inquiries and referrals from other institutions that it effectively outsourced part of its responsibility for detecting suspicious activity.
- Foreign correspondent accounts: The bank did not conduct required due diligence on certain foreign correspondent accounts.
- Red flags left open: Possible narcotics-trafficking proceeds, fraud and potential trade-based money laundering were not addressed in a timely way.
- Sanctions: OFAC cited 475 apparent violations, including payments through sanctioned banks, transactions by sanctioned individuals and failure to promptly update watchlists. OFAC classed them as non-egregious and largely not voluntarily self-disclosed.
- Resources: Treasury said the bank “prioritized its revenues” while minimizing the impact on compliance resources.
Role of the AML Compliance Function: Detection, Escalation, STR Filing and Remediation
The AML programme was the control that failed, at four points in a straight run from alert to action.
1. Detect: Monitoring coverage and thresholds did not catch activity that should have raised alerts.
2. Escalate: Potentially suspicious transactions were not referred for investigation, and the bank knew for years.
3. Report: Suspicious activity reports were filed late, covering more than $5 billion.
4. Remediate: After the 2024 cease-and-desist order, control breakdowns continued.
FinCEN called the violations willful. The bank’s own knowledge of the gaps, combined with inaction, is what separates a control weakness from a willful violation. The remediation terms also show what regulators expect next: independent reviews of monitoring and due diligence, and a look-back at what went undetected.
AML Compliance Lessons for Indian Banks and NBFCs: PMLA, RBI KYC Directions and STR Filing
Three lessons stand out. These are our reading of the case, not findings stated by the regulators.
Strengthen Transaction Monitoring: Own Your Detection
- Treasury said the bank leaned on law-enforcement inquiries and other institutions’ referrals for part of its detection.
- Your monitoring has to catch suspicious activity first, across every product, channel and data feed.
Review Alert Thresholds in Your AML Monitoring System
- The 2024 order cited a systemic failure to set appropriate thresholds for triggering investigations.
- Review alert thresholds on a schedule and test that they trigger investigations.
Track Audit and Regulatory Findings to Closure
- The OCC’s record penalty followed the bank’s failure to correct deficiencies under a 2024 cease-and-desist order.
- Track every audit and regulatory finding to closure, with an owner and a date.
Also Review: Correspondent Banking, Trade-Based Money Laundering and Sanctions Screening
- Correspondent and trade exposure: The case cited missing due diligence on foreign correspondent accounts and trade-based money laundering that went undetected.
- Sanctions list updates: OFAC cited failure to promptly update watchlists.
- Independent validation: The bank must undergo independent reviews of its monitoring and due-diligence programmes. Consider validating yours before a regulator asks.
AML Self-Assessment for Indian Banks and NBFCs: 10 Questions on STR Filing and Transaction Monitoring
Answer each question for your own institution. Every question rests on a stated provision. India’s 2024 FATF mutual evaluation rated Recommendation 20 (suspicious transaction reporting) Largely Compliant and Immediate Outcome 4 (preventive measures and STR reporting) at a Moderate level of effectiveness. It found commercial banks apply preventive measures well and smaller financial institutions lag behind.
| Serial | Test | Question | Source | Your answer |
| 1 | Principal Officer under PMLA and KYC Directions | Is your Principal Officer at management level, with name, designation and address reported to FIU-IND and contact details to RBI? | KYC MD paras 3(a)(xviii), 7(a) to (c) | |
| 2 | STR filing deadline: 7 working days | Do you record the date suspicion was established at Principal Officer level, and file the STR within 7 working days of that date? | PML Rules, Rule 8 | |
| 3 | Definition of a suspicious transaction | Does your alert-review checklist test all three limbs: possible proceeds of crime, unusual or unjustified complexity, and no economic rationale or bona fide purpose? | PML Rules, definition of suspicious transaction | |
| 4 | Structuring below reporting limits | Do you test for transactions split below prescribed limits to avoid reporting? | PMLA Section 12, proviso | |
| 5 | Transaction monitoring scenarios | Do your scenarios cover large and complex transactions, including RTGS, and high account turnover inconsistent with the balance maintained? | KYC MD para 36 | |
| 6 | Risk-based monitoring and customer risk categorisation | Is monitoring depth aligned to each customer’s risk category, and is risk categorisation reviewed at least once every six months? | KYC MD paras 12, 37, 37(1) | |
| 7 | Periodic KYC updation (Re-KYC) | Is periodic KYC updation on schedule: every 2 years for high-risk, 8 for medium-risk and 10 for low-risk customers? | KYC MD para 38 | |
| 8 | STR when CDD cannot be completed | Where CDD cannot be applied, or CDD would tip off the customer, do you consider filing an STR? | KYC MD paras 10(2), 11A | |
| 9 | Sanctions list screening | Do you have a suitable system to check customers against the sanctions lists indicated in Chapter IX of the Master Direction? | KYC MD para 10(9) | |
| 10 | KYC record retention and alert-to-STR audit trail | Can you retrieve transaction records for at least five years from the transaction date and identification records for at least five years after the relationship ends, with a trail from each alert to the filing decision? | KYC MD para 46(a) and (b). The alert-to-filing trail is good practice, not a stated rule |
Suggested scoring: 8 to 10 Yes means the pipeline looks sound. 5 to 7 means gaps to close. Below 5 needs a priority review with internal audit.
Numbering caution: Paragraph numbers are from the KYC Master Direction (2016, as amended). RBI consolidated many directions in 2025, so confirm the current numbering in the latest KYC Directions before citing a paragraph.
FAQs on STR, KYC and AML Compliance in India
Q. What is a suspicious transaction report (STR) in India?
An STR is a report the Principal Officer sends to FIU-IND about a suspicious transaction. Under the PML Rules, a suspicious transaction, whether or not made in cash, gives a person acting in good faith a reasonable ground of suspicion that it may involve proceeds of crime, appears to be made in circumstances of unusual or unjustified complexity, or appears to have no economic rationale or bona fide purpose.
Q. How many days do banks and NBFCs have to file an STR?
Rule 8 of the PML Rules requires the Principal Officer to furnish the information within 7 working days of establishment of suspicion at the level of the Principal Officer. Confirm the wording in the current PML Rules.
Q. How often is Re-KYC (periodic KYC updation) required?
At least every 2 years for high-risk customers, every 8 years for medium-risk customers and every 10 years for low-risk customers, under para 38 of the KYC Master Direction.
Q. How long must KYC and transaction records be kept?
Transaction records must be kept for at least five years from the date of transaction. Identification records must be kept for at least five years after the business relationship ends (para 46).
Q. Who is the Principal Officer under the KYC Master Direction?
An officer at management level nominated by the regulated entity, responsible for furnishing information under rule 8, ensuring compliance, monitoring transactions, and sharing and reporting information. The name, designation and address go to FIU-IND, and contact details go to RBI.
Strengthen Your Risk Management Skills with RMAI & SmartOnlineCourse
Professionals working in banking, treasury, audit, compliance and corporate risk management can strengthen their knowledge through RMAI and SmartOnlineCourse’s specialised professional learning programmes.
Explore learning opportunities in Market Risk, Enterprise Risk Management, Banking Risk, Governance and Compliance.
Get course details and learning recommendations, including curriculum, practical applications, certification information, eligibility, fees and enrollment guidance.
Sources and Verification Notes
Case facts
- Fox Business: Bank of America penalties
- Axios: Treasury and Bank of America fine
- IBTimes: Bank of America penalties
- Article text supplied by the user, quoting the Treasury and OCC press releases (Treasury release: home.treasury.gov, sb0657)
Indian framework
- RBI KYC Master Direction
- PML Rules, Rule 8 and suspicious transaction definition (SEBI page)
- FATF mutual evaluation of India, 2024
