On October 13, 2026, the US Treasury Department announced more than $1.2 billion in penalties against Bank of America, N.A. for willfully violating the Bank Secrecy Act. The penalty, the third largest in Treasury Department history, covers a seven-year period of AML program failures running from January 2018 through July 2025. As part of its FinCEN resolution, Bank of America admitted that it willfully violated the BSA. The OFAC matter resolved apparent sanctions violations through a settlement agreement. The consent order is 57 pages long and describes, in extraordinary detail, exactly what went wrong and how the bank knew about it long before regulators arrived.

The case is worth reading carefully. Not because Bank of America is unusual, but because the failures the consent order describes are structural. They are the kind of failures that accumulate quietly inside compliance programs that look functional on paper but are not calibrated to catch what they are supposed to catch.

The Three Violations

Bank of America admitted to three distinct violations of the BSA. The first was a failure to implement and maintain an AML program that met the minimum requirements of the law. The second was a failure to conduct due diligence for correspondent accounts maintained for foreign financial institutions. The third was a failure to file SARs on over $5 billion in suspicious transactions, more than $1 billion of which implicated national security-related and other priority illicit finance risks, including Chinese Money Laundering Networks, fraud, and potential trade-based money laundering with a substantial nexus to the southwest border.

The OCC separately assessed a $750 million civil money penalty, the largest in OCC history, for the bank's deficient and ineffective BSA/AML compliance program. OFAC announced a separate $11.6 million settlement agreement covering 475 apparent violations of multiple sanctions programs. The OCC's $750 million penalty is credited within FinCEN's $1.2 billion penalty; together with the OFAC settlement, Treasury announced total penalties of more than $1.21 billion. The actions were coordinated and announced concurrently.

"When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire US financial system to significant illicit finance risks."

Treasury Secretary Scott Bessent, October 13, 2026

The Transaction Monitoring System That Did Not Work

The center of the AML program failure was Event Processor, the bank's proprietary transaction monitoring system that it had built in 2010. EP was designed to aggregate individual transaction alerts into customer-level groups and create investigative cases when those groups accumulated enough weighted risk points to reach a 20-point threshold. The consent order describes, in meticulous detail, how that design failed over seven years.

Risk Factor Weights Not Grounded in Reality

The risk factor weights that determined how suspicious any given transaction pattern appeared in EP were, according to the consent order, largely unsubstantiated and not sufficiently anchored in relevant risks. High-yield alerts, those that frequently resulted in SAR filings, were assigned low point values that meant they rarely triggered investigations on their own. FinCEN found that cash structuring alerts with SAR yields above 50% were assigned weights of only 1 point. ATM large cash deposit alerts with a SAR yield of 56.75% were weighted at 1 point. From 2018 to 2023, 76% of all risk factor weights remained unchanged. Of the changes that were made, approximately 80% were decreases.

The bank's own testing identified these disconnects repeatedly. The consent order documents multiple internal reports, from 2019 through 2022, that found specific risk factors with high SAR yields assigned disproportionately low weights. In each case, the bank acknowledged the finding and largely did not act on it.

The 20-Point Threshold That Was Set By Judgment, Not Evidence

The 20-point threshold that determined whether an alert group became a case requiring investigation was, according to the consent order, set by "stakeholder judgment" at EP's inception and remained in place until December 2023. The consent order documents that by 2022 and early 2023, Event Groups scoring 16 to 19 points, just below the threshold, had SAR yields between 38% and 45%. Those yields were roughly seven to nine times higher than the 5% false negative tolerance the bank would eventually establish. The bank knew those groups contained suspicious activity. It did not investigate them.

When testing in 2022 found that an unconstrained threshold would uncover 85.4% more SARs in below-threshold activity versus the existing model's 20.2%, the bank rejected the change because of the "practical concern of pushing too many below-the-line event groups to cases." The consent order notes the expected SAR yield from those groups was roughly three to five times the benchmark the bank later adopted.

After extensive engagement with its prudential regulators and after FinCEN commenced its investigation, the bank lowered the threshold in December 2023 from 20 points to either 10 or 12 points, depending on characteristics of the Event Group. A subsequent lookback found that EP had missed nearly 8,900 SARs with transaction activity totaling nearly $4 billion. The bank estimated that the revised thresholds would add approximately 16,000 US investigations per month, requiring an incremental 750 personnel, in addition to 800 consultants needed to complete the one-time lookback.

Suppression Logic That Eliminated Suspicious Alerts

EP contained logic that automatically rescored certain risk factors to zero, preventing them from contributing to a case. These rules were developed in what the bank's own documentation described as an "ad-hoc and subjective fashion." A 2022 model validation found that rescored risk factors with high SAR yields included cash structuring at 37%, large cash deposits at multiple locations at 58%, and prepaid card ATM withdrawals at 53%. By December 2023, approximately 150,000 active Event Groups in EP had triggered one or more aspects of the rescoring logic. The bank removed all rescoring logic only after regulatory engagement.

The CDD Failures: Revenue Versus Compliance

The second major failure category in the consent order involves customer due diligence for a group of online auto auction customers. Two of those customers, referred to in the consent order as Customer A and Customer B, processed tens of billions of dollars in transactions through their Bank of America accounts during the relevant period. Both accepted large volumes of money orders purchased by third parties at other financial institutions and deposited at Bank of America, a pattern the consent order identifies as consistent with attempts to evade BSA identification and verification requirements. Both had substantial international wire activity involving high-risk jurisdictions including Georgia and Belarus.

What makes the CDD section of the consent order notable is the internal record it documents. By 2022, Bank of America's own compliance personnel had generated an extensive file of concerns about these customers. By July 2022, compliance had formally recommended that Customer A's accounts be closed. That recommendation was not carried out for years.

The consent order quotes internal communications at length. Compliance personnel described "an insane amount of cases/investigations." One email chain shows a compliance officer responding to a tally of more than 100 AML investigations connected to one customer with "YESSSSSSSSSSSS...Concern that the client does not have visibility or understanding of source of funds." Another described the account activity as "so vast" that the bank's internal investigative system was unable to download the relevant transactions for review.

In September 2022, a relationship manager responded to compliance's closure recommendation with a memo describing the customer as "a large and valued client" generating approximately $6 million in annual revenue, and noting that the relevant business line was "very supportive of our important relationship." By late 2022, compliance was describing "an insane amount of cases/investigations," connections to law enforcement inquiries from at least five federal agencies, and concerns about potential facilitation of transnational crime. The memo from the relationship manager acknowledged that "the industry isn't the cleanest" but cited the relationship's commercial importance as a reason not to close the accounts.

A March 2023 mitigation plan ultimately replaced the closure recommendation. Customer A continued processing third-party payments through its Bank of America account until June 2025.

What Was Not Reported: The SAR Failures

The consent order identifies multiple categories of SAR failures during the relevant period. In addition to the categories below, FinCEN found delayed or missed reporting of over $600 million in transactions with indicia of potential trade-based money laundering involving salvaged vehicles, roughly one-third of which had a nexus to the southwest border.

The first was the failure to timely report over $660 million in suspicious money order deposits from online auto auction customers. FinCEN's analysis found more than 220,000 unique groups of suspicious deposits, with approximately one in three having a geographic nexus to the southwest border. The deposits showed consistent patterns: round dollar amounts, sequential numbering, and groups of three money orders totaling just under $3,000, just below the threshold that would trigger identification and verification requirements on the issuing MSB. The consent order notes that another financial institution flagged the exact pattern to Bank of America in September 2021. The bank's response stated it had identified no unusual velocity patterns and no indicators of illicit activity. More than 51,000 additional suspicious groups were processed for that customer alone between October 2021 and May 2025 without timely reporting.

The second was the failure to timely report nearly $1 billion in suspicious wire transactions involving high-risk jurisdictions, primarily Georgia, Belarus, and other CIS nations. Roughly 98% of this activity by dollar value involved customers in auto-related industries. The bank's compliance personnel were aware of significant portions of this activity in late 2022. The first SAR covering a small portion of it was not filed until August 2023. The bulk was not reported until June 2025, after FinCEN made specific requests.

The third was the failure to timely detect and report credit card transactions consistent with Chinese money laundering network typologies, including high-volume back-to-back credit card purchases used to purchase electronics and luxury goods. FinCEN found that EP failed to include appropriate monitoring of credit card activity, contributing to delayed detection and reporting of hundreds of millions of dollars in transactions consistent with CMLN typologies.

The fourth was a broader category of suspicious activity that EP's design caused to go unreported because Event Groups expired before reaching the threshold or were aggregated so broadly that investigators could not reconstruct the full picture of the underlying activity when a case was eventually created. The consent order confirms that Event Groups had a 13-month window and that older alerts retired and no longer contributed to the score.

Four Compliance Lessons From the Consent Order

Frequently Asked Questions

The Sentinel Perspective

The Bank of America consent order is, at its core, a governance failure. The technology existed. The compliance team identified the risks. The internal testing surfaced the problems. None of that produced the outcome the BSA requires because the governance layer, the processes that translate identified risk into documented action, was not functioning. FinCEN also found that, for multiple years, more than one-third of the bank's suspicious-activity investigations were prompted by external events or manual referrals rather than the bank's own automated monitoring controls.

Sentinel supports the compliance layer that the consent order identifies as insufficient. Continuous customer screening against PEP databases, sanctions lists, and adverse media generates alerts when the risk profile of an existing customer changes, including when a customer publicly discloses a regulatory investigation. SAR filing workflows create documented decision trails that flag non-filing and require disposition records at each stage. And configurable risk profiles ensure that customer risk ratings are updated based on actual transaction behavior, not only when law enforcement arrives with a subpoena.

The question the consent order raises for every compliance program is the same one it raised at Bank of America: when your own testing identifies that your monitoring system is missing suspicious activity, what is the documented process for acting on that finding, and who is accountable for ensuring it happens?

Truth Technologies provides AML, KYC, OFAC, and sanctions screening compliance solutions through the Sentinel platform. This post is published for informational purposes only and does not constitute legal advice. All facts are sourced exclusively from the official FinCEN consent order and Treasury press releases linked above.