Bank of America Just Learned That “Too Big to Fail” Doesn’t Mean “Too Big to Comply”
The email landed in newsrooms late Tuesday afternoon, and within minutes, the financial world was doing the math. Bank of America, the second-largest bank in the United States, had just agreed to pay $1.21 billion to settle allegations that it failed, for years, to do one of the most fundamental things a bank is supposed to do: watch for criminals.
Not a rounding error. Not a slap on the wrist. A billion-dollar admission that the systems designed to catch money laundering, sanctions violations, and suspicious transactions simply didn’t work the way they were supposed to.
And here’s the part that should make every compliance officer in America sit up a little straighter: the bank admits it knew about the problems. It just didn’t fix them fast enough.
What Actually Happened Here
Let’s untangle this thing, because the numbers can get confusing fast.
The Treasury Department announced Tuesday that Bank of America would pay more than $1.21 billion in penalties. That total breaks down into three separate enforcement actions, each targeting a different failure.
The Financial Crimes Enforcement Network, FinCEN, the Treasury’s anti-money-laundering enforcement arm, assessed a $1.2 billion penalty. That’s the third-largest penalty in Treasury’s history. The Office of the Comptroller of the Currency, which supervises national banks, tacked on a $750 million civil money penalty. That’s the largest fine the OCC has ever imposed. And the Office of Foreign Assets Control, which handles sanctions enforcement, reached an $11.6 million settlement over violations of programs targeting Iran, Russia, narcotics trafficking, and global terrorism.
The $750 million OCC penalty counts toward the $1.2 billion FinCEN total, which is why the headline number sits at $1.21 billion rather than $1.96 billion. Regulators structure these things so penalties don’t stack endlessly, there’s a credit system involved. But don’t let the accounting mechanics obscure the scale. This is one of the largest anti-money-laundering settlements ever reached with a major U.S. bank.
For comparison: Binance paid roughly $4 billion in 2023. TD Bank paid about $3 billion the following year. Bank of America’s $1.21 billion sits firmly in that tier of enforcement actions that regulators reserve for what they consider systemic failures.
The $5 Billion They Didn’t Tell Anyone About
Here’s where the story gets genuinely uncomfortable.
As part of the FinCEN resolution, Bank of America admitted that it willfully violated the Bank Secrecy Act. That’s the 1970 law that requires financial institutions to help the government detect and prevent money laundering. The bank failed to maintain an anti-money-laundering program that met minimum legal requirements. It failed to conduct proper due diligence on correspondent accounts for foreign financial institutions. And it failed to file suspicious activity reports, the core mechanism by which banks alert law enforcement to potential criminal activity.
The consequence of those failures? The bank didn’t report more than $5 billion in suspicious transactions to FinCEN.
Let that sink in. Five billion dollars. Of that total, more than $1 billion involved activity tied to national security risks, including what Treasury described as Chinese money laundering networks, fraud, and potential trade-based money laundering along the southwest border.
But the story isn’t just about what the bank missed. It’s about how it missed it.
According to Treasury’s findings, Bank of America effectively outsourced a substantial portion of its detection and reporting obligations to third parties. Instead of relying on its own automated systems to flag suspicious activity, the bank waited for law enforcement inquiries and requests from other financial institutions to tell it what it should have already known. Suspicious activity accumulated uninvestigated for extended periods. Reporting, when it finally happened, was often too late to be useful.
And when internal testing highlighted significant problems? The bank failed to take meaningful action.
This wasn’t a case of a few missed transactions or a software glitch. It was a systemic breakdown in the controls that keep dirty money out of the U.S. financial system.
The Sanctions Problem Nobody’s Talking About Enough
The sanctions violations are a smaller dollar figure, $11.6 million, but they carry their own kind of weight.
OFAC determined that Bank of America committed over 400 apparent violations of various sanctions programs. The bank processed millions of dollars in payments that should have been blocked or rejected, including transactions tied to Iran, Russia, Belarus, and other sanctioned entities.
OFAC classified the violations as non-egregious but noted that they were largely not voluntarily self-disclosed. In regulatory language, that’s a polite way of saying: you got caught.
Sanctions compliance and anti-money-laundering compliance are often treated as separate disciplines inside banks. One team watches for suspicious activity; another team screens transactions against government watchlists. But Treasury Secretary Scott Bessent made a point of saying that financial institutions should treat these efforts as “effectively integrated and mutually reinforcing”.
Translation: the bad guys don’t care about your org chart. They’ll exploit whatever gap exists between your AML team and your sanctions team. And regulators are done pretending those gaps are acceptable.
A Bank That Knew Better
What makes this settlement particularly pointed is the timeline.
Bank of America agreed to a cease-and-desist order in 2024 related to deficiencies in its Bank Secrecy Act and anti-money-laundering compliance. That order was supposed to be a wake-up call. It wasn’t.
The OCC said in its enforcement action that the bank failed to make sufficient progress despite the earlier order. The compliance program remained “deficient and ineffective.” The bank’s transaction monitoring system caused delays in filing suspicious activity reports on billions of dollars in transactions.
This is the part that stings. Regulators don’t just look at whether a bank violated the law. They look at whether the bank knew it was violating the law and did nothing. In this case, the answer is uncomfortable.
Treasury’s press release states it plainly: “As these issues arose, Bank of America prioritized its revenues and minimized the impact on its required compliance resources”.
That sentence is the heart of the enforcement action. It’s not about technical failures. It’s about choices. The choice to spend money on revenue-generating activities rather than compliance infrastructure. The choice to let known problems linger. The choice to hope the regulators wouldn’t notice.
They noticed.
What Bank of America Says Now
To its credit, Bank of America isn’t fighting this. The bank issued a statement acknowledging the penalties and outlining its remediation efforts.
“Financial crime compliance is serious, and we are responsible for getting it right,” spokesperson Christa Robinson said. “We have invested billions of dollars in technology and dedicated thousands of employees to combat financial crime, and our team is far along with and committed to completing the work required to address the issues raised by our regulators”.
The bank also disclosed that the penalties will result in a $1.2 billion non-tax-deductible charge in its third-quarter results, reducing net income by approximately 17 cents per share. Shares dipped about 2% in after-hours trading on the news.
That’s a material hit to earnings, but it’s not existential. Bank of America remains one of the most profitable financial institutions in the world. The question isn’t whether it can absorb the fine. The question is whether it can genuinely fix the underlying problems.
The bank says it’s “far along” in remediation. Regulators will be the judges of that. And they’ll be watching closely.
The Bigger Picture: Enforcement Is Heating Up
This settlement didn’t happen in a vacuum.
Just days before Treasury announced the Bank of America penalties, American Express was hit with a $350 million penalty for similar anti-money-laundering shortcomings. The TD Bank case, a $3 billion settlement that included a guilty plea to criminal charges, is still fresh in everyone’s memory. And the Binance settlement, which involved sanctions and AML violations at a cryptocurrency exchange, showed that regulators are willing to reach beyond traditional banking.
The message is consistent: compliance failures have consequences. Big ones.
There’s also a philosophical shift happening in how regulators think about AML enforcement. For years, the focus was on process, did the bank have the right policies, the right procedures, the right training programs? Now the focus is on outcomes. Did the bank actually catch suspicious activity? Did it report it in time? Did its systems work?
FinCEN’s acting director, in announcing the penalty, emphasized that the bank’s failures “allowed billions of dollars in potentially illicit transactions to flow through the U.S. financial system unchecked”. That language matters. It’s not about paperwork. It’s about public safety and national security.
The Bank Secrecy Act was passed in 1970 to give law enforcement a window into the financial system. When banks fail to file suspicious activity reports, that window gets fogged up. When they fail to conduct due diligence on foreign correspondent accounts, they become conduits for money that shouldn’t be moving through the U.S. banking system at all.
The $5 billion in unreported suspicious transactions isn’t just an abstract number. It represents potential narcotics proceeds, potential fraud, potential sanctions evasion. Every dollar that flowed through Bank of America’s systems without being flagged is a dollar that some criminal organization got to use.
That’s the real cost of compliance failure. The fine is just the accounting.
What This Means for the Rest of the Industry
If you work in compliance at a large financial institution, this settlement should feel like a cold splash of water.
The era of “we’re working on it” is over. Regulators have made clear that they expect banks to identify problems, fix them, and demonstrate that the fixes actually work. Cease-and-desist orders aren’t suggestions. They’re deadlines.
There’s also a resource question here. Bank of America says it has invested billions in compliance technology and thousands of employees in financial crime prevention. If a bank of that size, with that level of investment, can still fail this badly, what does that say about smaller institutions?
The answer, uncomfortable as it may be, is that compliance is hard. It requires constant vigilance, constant investment, and a culture that treats financial crime prevention as a core business function rather than a cost center. Banks that treat compliance as an afterthought will find themselves in the same position Bank of America is in now: writing checks and issuing press releases about remediation.
The Treasury’s press release included a line that deserves to be read twice: “Given the converging nature of AML/CFT and sanctions-related risks, financial institutions should ensure their AML and sanctions compliance efforts are effectively integrated and mutually reinforcing”.
That’s a directive, not a suggestion.
The CEO Question
No conversation about Bank of America’s compliance failures is complete without mentioning Brian Moynihan.
Moynihan has been CEO since 2010. He took over in the aftermath of the financial crisis, when Bank of America was drowning in mortgage-related legal problems. For much of the past decade, he’s emphasized what he calls “responsible growth”, a strategy designed to distance the bank from the risk-taking that nearly destroyed it in 2008.
The irony isn’t lost on anyone. Moynihan spent years telling investors that Bank of America had cleaned up its act. Now his bank is paying one of the largest AML penalties in history.
To be fair, the compliance failures described in the Treasury settlement aren’t the same kind of reckless risk-taking that caused the financial crisis. They’re failures of oversight and investment, not failures of judgment about mortgage-backed securities. But they’re still failures. And they happened on Moynihan’s watch.
The bank’s stock dipped modestly on the news, which suggests investors aren’t panicking. But the reputational damage is real. Bank of America now joins a list of institutions, TD, Binance, and others, that have been publicly shamed by regulators for failing to keep dirty money out of the financial system.
That’s not a list any bank wants to be on.
What Happens Next
Bank of America has agreed to a consent order as part of the settlement. That means regulators will have ongoing oversight of the bank’s compliance remediation efforts. External auditors will review suspicious transaction analysis. The bank will have to demonstrate, not just claim, that its AML and sanctions programs are working.
The $1.21 billion penalty is paid. But the work isn’t done. If the bank fails to meet the terms of the consent order, it could face additional penalties and restrictions on its business activities.
For the broader financial industry, the message is clear: regulators are willing to impose nine-figure penalties on the biggest banks in the country. They’re willing to publicly document failures in excruciating detail. And they’re willing to keep the pressure on until the problems are actually fixed.
The Bank Secrecy Act is more than 50 years old. It’s been amended, strengthened, and reinterpreted dozens of times. But its core purpose hasn’t changed: make banks partners in the fight against financial crime.
Bank of America forgot that. Now it’s paying $1.21 billion to remember.
The rest of the industry would be wise to take notes.
Comments
Post a Comment