Bank of America fined US$1.2bn over money laundering, sanctions breaches

US federal authorities have fined Bank of America over US$1.2bn for violations of financial crime laws, accusing the lender of handling billions of dollars in transactions potentially linked to trade-based money laundering, fraud and sanctions.

The Financial Crimes Enforcement Network (FinCEN) announced today it had issued a US$1.2bn penalty to the New York-headquartered banking giant, the third largest penalty in its history, for deficiencies in anti-money laundering controls.

It said there were deficiencies in Bank of America’s anti-money laundering controls, but the bank “prioritised its revenues and minimised the impact on its required compliance resources”, including by outsourcing suspicious activity detection and reporting to third parties.

The Office of the Comptroller of the Currency (OCC) also levelled a US$750mn civil monetary penalty against the bank – its largest ever – following “widespread breakdowns” in anti-money laundering controls. The amount is included within the FinCEN penalty and is to be paid to the Treasury.

At the same time, the Office of Foreign Assets Control (OFAC) announced a US$11.7mn settlement with Bank of America after nearly 500 alleged violations of sanctions programmes, including those targeting Russia, Iran and global terrorism.

“When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire US financial system to significant illicit finance risks,” said Treasury secretary Scott Bessent.

“Today’s actions send a clear message that even the biggest financial institutions are not above the law.”

Bank of America said in a statement that “financial crime compliance is serious, and we are responsible for getting it right”, saying it worked to reach resolutions with the trio of regulators.

“We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime, and our team is far along with and committed to completing the work required to address the issues raised by our regulators,” it said.

In FinCEN’s case, the agency said that between January 2018 and July 2025, Bank of America failed to implement and maintain controls to comply with the Bank Secrecy Act (BSA).

It said there were “critical deficiencies and gaps” in its transaction monitoring system, meaning the bank missed or delayed reporting more than US$5bn in suspicious activity.

FinCEN said around US$1bn of that total related to national security and illicit finance risks, including potential trade-based money laundering associated with the US’s southwest border, as well as Chinese money laundering networks and fraud.

FinCEN took aim at the bank’s management, citing an incident where internal testing of controls produced unfavourable results. It said the bank’s then-global head of financial crimes directed a manager to repeat the test, which then produced better results.

Compliance staff also identified third-party payments involving high-risk customers as a “core risk”, but Bank of America “prioritised the revenue associated with those customer relationships… without any changes to its approach”, FinCEN said.

The agency added that although Bank of America had developed a trade-based money laundering feature by early 2024, designed to indicate potential illicit activity, it only deployed it to activity already subject to investigation.

The OCC also highlighted trade-based money laundering risks, including that Bank of America did not effectively monitor negotiable instrument deposits into accounts of high-risk customers, even after the regulator identified red flags and communicated its concerns to the bank.

Despite a 2024 order requiring the bank to address deficiencies in its anti-money laundering programmes, the OCC said Bank of America “still failed to prioritise” compliance.

The bank “has a high, and increasing, risk profile for money laundering, terrorist financing and other illicit activities”, yet has not fixed “longstanding BSA deficiencies”, it said.

OFAC’s enforcement action related to alleged sanctions breaches, rather than anti-money laundering.

It said that between 2021 and 2025, Bank of America engaged in 475 apparent violations of sanctions programmes targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism, across transactions totalling nearly US$15mn.

OFAC said payments were routed through a directory of banks provided by a third-party vendor, some of which turned out to be subject to US sanctions. Issues generally occurred because sanctions screening filters had not been updated in time, or because of human error in assessing false positives.

Although Bank of America became aware of these issues in March 2022, it did not examine the full scope of its payment activity until an OFAC administrative subpoena in January 2025, the authority said.

The bank also “submitted piecemeal or incomplete disclosures or responses to OFAC”, and its “delays and less than fulsome cooperation” slowed the investigation process, it said.