The Treasury Department imposed the third-largest penalty in its history on the second-largest US bank, saying it failed to report more than $5 billion in suspicious transactions, including activity tied to Chinese money laundering networks and sanctions programmes.
Published 14 October 2026 · 04:42 GMT
On Tuesday 13 October 2026, the United States Treasury Department announced enforcement actions imposing more than $1.21 billion in penalties on Bank of America, the second-largest bank in the United States, for violations of anti-money laundering and sanctions laws. The package is the third-largest penalty in the Treasury Department's history, and it contains the largest penalty the Office of the Comptroller of the Currency has ever imposed on a bank.
The headline number is built from three parts. The Financial Crimes Enforcement Network, known as FinCEN, assessed a $1.2 billion penalty. The Office of the Comptroller of the Currency assessed a $750 million civil money penalty, which is credited toward the FinCEN amount rather than added to it. The Office of Foreign Assets Control announced a separate $11.6 million settlement over sanctions violations. Together, the three actions reach just over $1.21 billion.
Bank of America is headquartered in Charlotte, North Carolina, and operates in more than 150 countries. As part of its resolution with FinCEN, the bank admitted that it willfully violated the Bank Secrecy Act of 1970, the law that requires financial institutions to help the government detect and prevent money laundering. The announcement landed hours before the bank was due to report third-quarter earnings on Wednesday 14 October. The bank said the penalties will produce a $1.2 billion non-tax-deductible charge in those results, cutting net income by about 17 cents per share. Its shares fell about 2.4 percent in after-hours trading after the announcement.
FinCEN's case centres on risks the bank failed to mitigate and report. The agency said Bank of America failed to address priority national security risks, including Chinese money laundering networks and illicit finance along the southwest border. Its failures involved deficiencies in identifying and reporting suspicious transactions and in customer due diligence. According to the Treasury statement, the bank effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations.
The scale of the unreported activity is the core of the case. The bank failed to timely report to FinCEN more than $5 billion in suspicious transactions, the Treasury said. More than $1 billion of that sum involved national security risks and other high-priority financial crime, including fraud and possible trade-based money laundering connected to the southwest border. Regulators also said red flags raised by compliance staff, including customers tied to narcotics trafficking, drew no timely, meaningful response.
The currency regulator's case is about a programme that never got fixed. The OCC said the bank's anti-money laundering programme was deficient and ineffective. The bank was already subject to a December 2024 cease-and-desist order requiring it to address those deficiencies, but it still failed to prioritise compliance, the Treasury said. On sanctions, OFAC said the bank processed millions of dollars in payments in apparent violation of sanctions programmes across 475 apparent violations, with commitments on training, testing and audit.
The bank's response stressed investment and remediation. It said: "Financial crime compliance is serious, and we are responsible for getting it right." It said it had invested billions in technology and thousands of employees in combating financial crime, and that remediation was far along. A spokesperson added that remediation costs were already in its expense base.
The announcements do not name the customers or the individual transactions behind the unreported activity. No individual executives were named, and no charges against individuals were announced. The public record therefore shows a failure of systems and oversight at the level of the institution, without a public account of who inside the bank knew what, and when.
Several other questions remain open. The failures are described as having persisted for years, but the announcements do not set out a precise start date. A consent order is reported to require an independent third party to review the bank's past transactions, and that review could yet surface further problems, but its scope and timetable have not been laid out in full. It is also not yet clear whether regulators will take further action, or how they will judge the remediation complete.
Banks are the front line of the financial system's defences. When a customer moves money that looks suspicious, the bank is supposed to notice, investigate, and file a suspicious activity report with the authorities. When the second-largest bank in the United States lets more than $5 billion of such activity go unreported, the gap is not a paperwork error; it is a hole in the filter through which dirty money reaches the legal economy.
Treasury Secretary Scott Bessent framed the case in exactly those terms, saying that when a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire US financial system to significant illicit finance risks, and that the actions send a clear message that even the biggest financial institutions are not above the law.
The stakes are also about confidence. A financial system that cannot police its largest members invites harsher regulation, costlier supervision, and the withdrawal of correspondent relationships from smaller banks that counterparties judge risky. The case lands alongside signs of resilience elsewhere: the International Monetary Fund's latest global forecast shows growth holding up, but that growth rests on trust in the plumbing of finance.
The single most consequential word in the Treasury announcement is "willfully". Bank of America admitted that it willfully violated the Bank Secrecy Act, and failed to maintain an anti-money laundering programme meeting the law's minimum requirements, to conduct due diligence for correspondent accounts, and to file suspicious activity reports. That admission, not sloppy paperwork, is a large part of why the penalty reached record levels.
The pattern around the case matters as much as the admission. The bank was already under a December 2024 cease-and-desist order to fix its anti-money laundering programme. Regulators say it did not prioritise the fix. The case also follows a clear enforcement escalation. In 2024, TD Bank pleaded guilty and agreed to pay more than $1.8 billion over money laundering failures, including funds routed through Chinese networks.
There is a genuine debate underneath the numbers. The bank says it has invested billions in technology and thousands of employees in financial crime compliance, and that remediation is far along. Regulators say the programme was deficient and ineffective and that red flags were escalated internally without a timely, meaningful response.
The second-order effects will show up across the financial sector. Every major bank with a US licence will be re-reading its own suspicious activity reporting, its reliance on third-party detection vendors, and its handling of escalated red flags.
The sanctions side of the case reaches further still. The OFAC settlement, covering 475 apparent violations across programmes aimed at Iran, Russia, narcotics and global terrorism, is a reminder that sanctions enforcement now runs through the same compliance departments as anti-money laundering, and that wartime sanctions regimes raise the stakes of every missed payment screen. Sanctions and battlefield pressure are part of the same contest, as the Bureau reported in its coverage of Russian strikes on Kyiv's energy infrastructure. Banks that move money for the world cannot treat sanctions screening as a back-office function when sanctions are an instrument of war.
There is also a risk in the opposite direction. When penalties grow and scrutiny tightens, big banks often respond by shedding clients and markets they judge too risky to serve. That de-risking can push legitimate businesses and remittance flows in developing economies out of the regulated system entirely, into channels that are harder to police.
The immediate test is the earnings call. Bank of America reports third-quarter results on Wednesday 14 October, and analysts are expected to press chief executive Brian Moynihan on the charge and on remediation costs. The bank has said the $1.2 billion charge and the 17 cents per share effect are in the quarter's figures, and that remediation costs are already in its expense base.
Beyond earnings, the machinery of the settlement takes over: an independent third-party review of past transactions, OFAC compliance commitments on training, testing and audit, and OCC follow-up on the 2024 order. In Washington, the era of treating compliance failure as a manageable cost appears to be over.
Western coverage has centred on enforcement, deterrence, and earnings. The dominant question in Washington and on Wall Street is whether a $1.21 billion penalty, large as it is, changes behaviour at a bank of this size, or whether it is absorbed as a cost of doing business. The Treasury's framing, that even the biggest institutions are not above the law, was read as a deliberate signal: a record OCC penalty, a willful-violation admission and a fine landing the night before earnings.
Read from the East, the case is inseparable from the American framing of Chinese money laundering networks as a national security threat. FinCEN's August 2025 advisory described professional networks that move cartel drug proceeds through US accounts, often by matching them against demand for US dollars from Chinese nationals seeking to evade China's currency controls. The announcements themselves contain no Chinese government response, and the case turns on the bank's failures rather than on any finding against Beijing. The same contest over rules and market access plays out in industry, where Chinese carmakers are bringing production into the EU.
From the Global South, the striking detail is the geography of the money. The unreported activity ran through the southwest border, where Mexican cartels generate dollar proceeds from drug sales, and through trade channels that reach deep into Latin America. Southern economies live with the violence and corruption of that trade, while the laundering itself passed through the accounts of one of the richest banks in the world. There is also a practical worry: every record penalty in Washington tends to raise compliance costs everywhere, and smaller banks in Africa, Latin America and Asia, which depend on correspondent relationships with big US banks, are often the ones that lose access when the giants tighten up.
Regulators say the bank failed at the basic job of spotting and reporting suspicious money. It did not timely report more than $5 billion in suspicious transactions, outsourced much of its detection work to third parties, and did not act quickly on red flags its own staff raised, including customers tied to narcotics trafficking. It also processed payments that apparently violated sanctions programmes.
The total combines three actions that partly overlap. FinCEN assessed $1.2 billion. The OCC assessed $750 million, but that amount is credited toward the FinCEN penalty rather than added to it. OFAC added a separate $11.6 million sanctions settlement. The combined total therefore lands just above $1.21 billion, rather than at the sum of all three headline numbers.
They are professional networks that move illicit money through the financial system, often by matching cartel drug proceeds in US dollars against demand for dollars from Chinese nationals seeking to evade China's currency controls. FinCEN's 2025 advisory linked them to about $312 billion in suspicious activity reported between 2020 and 2024, much of it tied to Mexico-based cartels, trade-based laundering, and real estate.
For most customers, the direct effect should be limited: deposits and day-to-day banking are unaffected, and the bank says remediation costs are already in its expense base. The wider effect is tighter compliance, which can mean more questions about unusual transactions and, in some markets, banks withdrawing from clients they judge too risky to serve.
