Bank of America has been hit with a $1.2bn fine after US authorities found serious failings in its Anti-Money Laundering (AML) controls, including delays in reporting more than $5bn in suspicious transactions.
According to the US Treasury, the bank knew about weaknesses in its controls but did not take meaningful action, while compliance resources were given lower priority than revenue. Suspicious activity went uninvestigated for extended periods, and the bank relied heavily on external enquiries and referrals to identify risks its own systems should have detected.
The enforcement action announced on 13 October 2026 also included a $750m civil money penalty from the Office of the Comptroller of the Currency (OCC) and an $11.6m settlement with the Office of Foreign Assets Control (OFAC) over apparent sanctions violations.
What went wrong at Bank of America to lead to this AML fine?
More than $5bn in suspicious transactions reported late
FinCEN, the US Treasury bureau responsible for tackling financial crime, found that Bank of America failed to report more than $5bn in suspicious transactions in a timely manner. More than $1bn of that activity involved priority illicit finance and national security risks, including suspected Chinese money laundering networks, fraud and potential trade-based money laundering linked to the US southwest border.
The bank admitted that it had wilfully violated the Bank Secrecy Act. Among the failures identified were shortcomings in its AML programme, due diligence on correspondent accounts held for foreign financial institutions, and the filing of suspicious activity reports (SARs).
A suspicious activity report filed after a lengthy delay may provide limited value to investigators, particularly when money has already moved through multiple accounts or jurisdictions. Reporting backlogs can also mask a deeper problem: a firm may be generating alerts without having the capacity or processes to investigate them properly.
For firms in the UK, for example, the equivalent concern is not simply how many suspicious activity reports are submitted to the National Crime Agency, but whether suspicious activity is recognised, investigated and reported promptly enough to be useful.
Customer due diligence failed to reflect payment behaviour
The Treasury also identified shortcomings in Bank of America’s customer due diligence (CDD). Its processes did not adequately account for customers’ extensive reliance on payments from unknown third parties.
Red flags involving potential narcotics proceeds, trade-based money laundering and fraud accumulated. Compliance staff raised concerns, but the bank failed to respond meaningfully and in good time.
This points to a gap between knowing a customer on paper and understanding how they actually use their account. A customer’s expected activity, counterparties and payment patterns should form part of the firm’s ongoing risk assessment. When real activity moves away from that picture, the difference needs to be examined.
The same principle applies to regulated firms carrying out customer due diligence and Know Your Customer (KYC) checks.
A customer may pass initial KYC checks, with valid identity documents, a verified address and a plausible explanation for opening the account, but their ongoing activity may tell a different story. Unexplained payments from third parties, international transfers that don’t fit their known profile, or sudden changes in account activity should prompt a review of the customer’s risk rating and due diligence information, rather than simply an update to their file.
Sanctions screening failures added to the problem
The separate OFAC settlement concerned 475 apparent violations of US sanctions programmes targeting Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism.
The failures included processing correspondent banking payments involving blocked banks, allowing designated individuals to make payments or withdraw funds, delays in updating sanctions watchlists, and errors involving business accounts associated with blocked persons. OFAC attributed the issues to a combination of technical problems, poorly prioritised alerts and human error.
The lesson is that sanctions screening cannot operate as a standalone exercise. Watchlists need to be updated promptly, alerts need to be prioritised properly, and staff need clear procedures for investigating potential matches. The process also needs regular testing to identify cases where technical rules or manual handling allow prohibited payments to get through.
What can compliance teams learn from Bank of America’s AML fine?
CDD information can quickly become outdated if it is treated as a one-off exercise at onboarding. Customer risk assessments need to reflect actual account activity, not simply the information collected when the relationship began.
Unexpected third-party payments, changes in transaction volumes, unusual counterparties or flows that do not fit the stated purpose of an account may all justify further enquiries.
The key is to connect monitoring with customer information. An alert is easier to assess when investigators can see the customer’s expected activity, ownership, business model and known counterparties. Equally, a change in behaviour may be the first indication that an existing customer risk rating needs to be reconsidered.
For AML teams, the lesson is to keep customer due diligence up to date and make sure risk assessments reflect what is known about each customer, not just the information collected at onboarding. KYC checks should go beyond verifying identity and address to build a clear picture of the customer’s background, source of funds and expected account activity.
If new information raises questions about the customer’s circumstances or the legitimacy of their funds, firms should review the customer’s risk rating, request further evidence where needed and escalate concerns appropriately. Just as importantly, compliance teams need the resources and authority to act on red flags, while senior management must take responsibility for making sure identified weaknesses are properly addressed rather than left unresolved.
