Bank of America's $1.2 Billion AML Penalty: What Monitoring Agents Would Have Flagged
The second-largest bank in the US admitted it let suspicious activity pile up uninvestigated and relied on outside tips to find crime in its own accounts. Each finding maps to a control you can test today.
Short Answer
On 13 October 2026, US Treasury announced more than $1.21 billion in penalties against Bank of America. FinCEN assessed $1.2 billion, crediting a $750 million OCC penalty against it, and OFAC settled 475 apparent sanctions violations for $11.6 million. The bank failed to report on time over $5 billion in suspicious transactions, more than $1 billion of them tied to national security risks. Regulators found alerts that went uninvestigated, activity never escalated to investigators, and a bank that waited for law enforcement to tell it what to look at. Agents that investigate every alert as it arrives, and look across customers for networks, target those exact failures.
Key Takeaways
- FinCEN's $1.2 billion penalty is the third-largest in Treasury history. The OCC's $750 million is the largest that agency has ever imposed.
- The bank admitted it willfully violated the Bank Secrecy Act, including by failing to file SARs.
- Treasury said the bank "effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations."
- The OCC found the bank knew for years that it was not escalating potentially suspicious activity, and still had not fixed it more than a year after a December 2024 order.
- Named risks include Chinese money laundering networks, illicit finance along the southwest border, trade-based money laundering and payments from unknown third parties.
What regulators found
The Treasury and FinCEN releases describe four failures.
Alerts that sat. FinCEN said the bank allowed suspicious activity to accumulate uninvestigated for extended periods, which led to late reporting. The OCC said the monitoring system failed to properly monitor "trillions of dollars" in transactions, producing late SARs on billions of dollars.
No escalation. The OCC found the bank knew for years that it was not escalating potentially suspicious activity to investigators. More than a year after the December 2024 cease-and-desist order, it still had not. A systemic gap let potential trade-based money laundering transactions through.
Detection by subpoena. Treasury said the bank leaned on law enforcement inquiries and referrals from other banks to find suspicious activity, instead of finding it through its own controls. In Treasury's words, institutions cannot "rely on law enforcement inquiries, referrals from other financial institutions, or other external sources as substitutes."
Thin customer due diligence. FinCEN said the bank did not account for customers who relied on payments from unknown third parties, including payments with potential ties to narcotics proceeds. On sanctions, OFAC cited correspondent payments routed through blocked banks, delayed watchlist updates, and designated persons who could still make payments and withdraw funds.
Treasury also said the bank "prioritized its revenues and minimized the impact on its required compliance resources" and "failed to take meaningful action even in the face of testing that highlighted significant problems."
The bank said it is responsible for getting financial crime compliance right and has invested billions in technology and staff. It must now run a third-party lookback to find and report undetected suspicious transactions, and commission independent reviews of monitoring, due diligence, correspondent banking and data governance.
Failure by failure: what an agent does differently
No software would have fixed a bank that chose revenue over compliance staffing. That decision belongs to people. But the specific control failures in these orders are the ones monitoring agents are built to close. Here is how each maps.
Alerts that sat → every alert investigated on arrival. The backlog exists because a person has to gather context before anyone can decide. In Verifica, task agents pull the customer's profile, expected activity, history, account changes, devices and linked customers the moment an alert fires, and a reasoning agent writes up the finding. The case reaches an officer ready for a decision, with a recommendation attached. Explained activity closes with the reason recorded. Nothing waits in a queue for someone to start the research.
No escalation → a recommendation on every case and a log of who acted. Each finding ends in a recommendation: clear, hold and call back, or escalate. An escalation recommendation that nobody acts on stays visible as an open item with a timestamp. An examiner can see how long each case waited and who decided it. A bank cannot go years without escalating when the log shows each unescalated recommendation.
Detection by subpoena → proactive network detection. Chinese money laundering networks and mule schemes spread activity across many accounts so no single account looks unusual. Verifica's attack radar looks across the whole customer base: the same payout or payer account used by unrelated customers, the same device or IP address, many customers paying a newly seen counterparty, and spikes in bank-detail changes against a 28-day baseline. Those are the patterns a bank finds today only when a subpoena names the accounts.
Unknown third-party payers → a scenario for it. Third-party payers and payees, pass-through movement, activity above the expected profile and high-risk jurisdictions are standard AML scenarios in Verifica, each mapped to its FATF, FinCEN or FFIEC source. When a customer starts receiving funds from people with no visible connection, the rule fires and the agents trace who the payers are and what else they touch.
Ignored testing → back-tests and versions on every rule. Before a threshold change goes live, Verifica runs it against the last 90 days and shows what it would have caught and missed. Every rule version keeps its justification and its author. When testing shows a gap, the record of what you did about it sits next to the rule.
Sanctions lapses → screening inside the same file. Delayed watchlist updates and blocked persons who kept transacting are screening failures. Verifica screens customers and beneficial owners on LSEG Risk Intelligence and re-screens them after onboarding. A new or changed hit goes back to the analyst queue with the file and audit trail updated.
The lesson for smaller institutions
Bank of America had thousands of compliance staff and still fell behind. A payment institution, credit union or fintech with ten analysts faces the same arithmetic at a smaller scale: alerts grow with customers, analysts don't. Hiring more people to open the same twenty tabs per alert does not change that arithmetic. Agents do the gathering and the write-up so your team spends its hours deciding.
Regulators have also told you how they will judge you. They will ask whether you found suspicious activity yourself or waited for someone to point at it. An agent-reviewed case file, with evidence, a recommendation and a named decision-maker, answers that question.
See AI agents for transaction monitoring for how the platform works, or read how AI agents change a compliance team's day.
Sources: US Treasury press release, 13 October 2026 · FinCEN, "FinCEN Assesses $1.2 Billion Penalty against Bank of America" · BNN Bloomberg · CNBC · OCC cease-and-desist order, December 2024
Rodolfo Santos is a real estate compliance attorney with 10+ years of experience in cross-border transactions and the co-founder of Verifica, an AI-powered compliance platform for real estate professionals. He has closed over 150 property transactions worth more than €50 million.
