Treasury announced more than $1.21 billion in penalties against Bank of America on October 13, calling it the third-largest penalty in Treasury history. The bank is the second-largest in the United States, and Treasury Secretary Scott Bessent said in the department’s release that “even the biggest financial institutions are not above the law.” Treasury says the bank failed to report to the Financial Crimes Enforcement Network (FinCEN) over $5 billion in suspicious transactions.

How three penalties add up to $1.21 billion

The total combines actions by three Treasury offices. FinCEN imposed a $1.2 billion penalty for failing to mitigate and report priority national security risks. The Office of Foreign Assets Control (OFAC) settled 475 apparent sanctions violations for $11.6 million. Those two figures together make the headline number of more than $1.21 billion.

FinCEN is the Treasury bureau that collects suspicious activity reports, the filings banks must make when a transaction looks like money laundering or fraud. OFAC enforces U.S. sanctions programs and administers the lists of blocked people and banks. Both penalties come from rules every large bank is expected to follow.

The Office of the Comptroller of the Currency (OCC), the national bank regulator, also imposed a $750 million civil money penalty. The OCC’s release says FinCEN’s $1.2 billion credits the OCC’s $750 million penalty, so the two are not added together.

The question most Bank of America customers have is whether any of this reaches their account. Treasury’s release describes penalties paid to the government and does not announce refunds, fee changes or restrictions on customer accounts. The OCC’s penalty is payable to Treasury and is not a customer refund.

Treasury announced the penalties on October 13, and the bank still owes a third-party lookback and independent reviews that have no published end date.

Get the deadline alerts before they pass →

What FinCEN says the bank did not report

FinCEN found that the bank willfully violated the Bank Secrecy Act, and the bank admits it. According to Treasury, the bank failed to maintain an anti-money-laundering program that met the law’s minimum requirements, failed to do due diligence on correspondent accounts for foreign financial institutions, and failed to file suspicious activity reports on time.

The unreported activity totals over $5 billion in suspicious transactions, with over $1 billion tied to national security and other priority risks, Treasury says. The priority risks it names include suspected Chinese money laundering networks, fraud, and potential trade-based money laundering linked to the southwest border. Treasury says the bank put revenue ahead of compliance resources and leaned on law enforcement inquiries and other outside parties rather than its own automated controls.

Suspicious activity sat uninvestigated for long periods, according to the release, and customer due diligence did not account for customers’ heavy reliance on payments from unknown third parties. Red flags such as possible narcotics trafficking proceeds were not handled in time.

The OCC’s findings after a December 2024 order

The bank was already operating under a December 2024 cease-and-desist order from the OCC. Treasury says that more than a year later the bank still had not escalated potentially suspicious activity for investigation, and that a systemic monitoring gap let potential trade-based money laundering transactions through.

The OCC’s findings run through the bank’s compliance chain. Its transaction monitoring failed to properly monitor trillions of dollars in transactions, which led to late suspicious activity reports involving billions of dollars. The staff running the program lacked sufficient skills and key personnel had not been trained to spot and report suspicious activity. The bank’s audit function missed longstanding concerns that examiners later found.

The sanctions part of the settlement

OFAC’s $11.6 million settlement covers 475 apparent violations. OFAC deemed them non-egregious and largely not voluntarily self-disclosed. Treasury says correspondent payments were routed through blocked banks because of technical and human error, designated individuals were able to make payments and withdraw funds because alerts were poorly calibrated, and watchlists were not promptly updated after OFAC designations. The payments touched sanctions programs for Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism, and Treasury says millions of dollars in payments were processed.

What the penalties require of the bank, and of customers

The release puts the work on the bank. Treasury requires a third-party lookback to identify and report suspicious transactions that were never reported to FinCEN, plus independent reviews of suspicious activity monitoring, customer due diligence, foreign correspondent due diligence and data governance. The reviews focus on the southwest border, cartels, narcotics trafficking, Iran and Russia. OFAC adds compliance commitments covering training, testing and audit, and communication with OFAC.

Nothing in the release asks customers to do anything, and it does not quantify any harm to them. For an account holder the practical step is the ordinary one: read the monthly statement, and treat an unfamiliar transaction or a letter asking for account information as something to call the bank about using the number on the card.

FinCEN is also taking tips. Treasury says its whistleblower program can pay awards when information leads to a successful action with penalties over $1 million.

More Financial Reading

• 24 Ways to Stretch a $2,087 Social Security Check
• 17 Places to Find Your Share of the $4.25 Billion States Give Back
• 16 Steps to Stop the Scams That Took $7.7 Billion From Seniors

This article was produced with AI assistance and edited for accuracy against the sources linked above.