Three Agencies, One Message: Bank of America’s $1.96 Billion Penalty Is the Cost of Operating on Legacy Compliance
Three Treasury agencies moved against Bank of America in a single coordinated action on October 13, and the structure of the strike tells you more than the dollar figure does. FinCEN assessed $1.2 billion. The OCC added $750 million , its largest penalty in history. OFAC tacked on $11.6 million for 475 sanctions violations. The gross total: approximately $1.96 billion, and the combined FinCEN assessment of $1.2 billion is the third-largest in Treasury history. When three agencies coordinate at this scale, the penalty is not just a punishment. It is a map of where the structural fault lines sit in the current financial regime, and any institution building on the new agent compliance framework should be reading it closely.
The findings from the OCC and FinCEN describe a compliance program that was not merely underfunded but structurally broken. Bank of America admitted to willful Bank Secrecy Act violations: failure to implement and maintain an adequate anti-money laundering program, failure to conduct due diligence for correspondent accounts of foreign financial institutions, and failure to file Suspicious Activity Reports. The bank failed to report over $5 billion in suspicious transactions to FinCEN, with over $1 billion implicating national security risks, including Chinese money laundering networks and illicit finance along the southwest border.
The OCC found that the bank’s deficient transaction monitoring system failed to properly monitor trillions of dollars in transactions, producing large numbers of late SARs involving billions of dollars, many carrying indicia of money laundering. The bank’s BSA officer and staff lacked sufficient skills and expertise. Key personnel did not receive appropriate training. The audit function failed to identify long-standing concerns that examiners subsequently uncovered. The bank was already operating under a December 2024 cease-and-desist order that required it to fix these exact deficiencies, and the OCC found it had not completed many of the significant steps needed. More than a year after that order, the bank was still failing to escalate suspicious activities to investigators and was still processing potential trade-based money laundering transactions due to a systemic gap in its monitoring program.
Comptroller Jonathan V. Gould stated the structural problem plainly: “Bank of America, N.A., is the second largest bank in the U.S. and the sixth largest in the world. Every year, it processes hundreds of trillions of dollars in transactions across the globe. It has a high, and increasing, risk profile for money laundering, terrorist financing and other illicit activities. Almost two years ago, the bank signed an order with the OCC and committed to fixing its longstanding BSA deficiencies. Despite its obligation to the American people as a national-chartered, global systemically important bank, the bank’s BSA/AML compliance program continues to reflect widespread breakdowns in internal controls, which threatens U.S. national and economic security.”
On the sanctions side, OFAC found 475 apparent violations across programs targeting Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism, running from September 2021 through April 2025. The bank processed payments involving blocked banks, failed to prioritize alerts for exact-match customers, failed to update watchlists promptly, and mishandled accounts associated with blocked persons. The violations were classified as non-egregious but largely not voluntarily self-disclosed.
This enforcement action validates the “Pipe Control” thesis. The Philippines central bank restricted inbound rails to control the stablecoin gateway; the logic here is identical, operating at a larger scale. While the industry watches the GENIUS Act build a new regulatory framework, regulators are aggressively policing the legacy rails that bridge into it. If you control the pipe, you control the flow. Treasury Secretary Scott Bessent stated: “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks.”
The market reaction priced the structural risk. BAC closed at $49.34 on October 14, down 8.56% in a single day, the steepest decline since April 2025. The penalty was absorbed into the bank’s Q3 2026 earnings. The bank stated it has invested heavily in compliance and is “far along” in remediation, adding that “financial crime compliance is serious, and we are responsible for getting it right.” The market, evidently, prefers the evidence of the enforcement record over the promise of the remediation timeline.
The GENIUS Act, effective January 18, 2027, will require stablecoin issuers to operate as BSA financial institutions. This case is the preview. If the second-largest bank in the country, with thousands of compliance staff and a prior cease-and-desist order telling it exactly what to fix, could not keep its monitoring program functional, the regulatory expectation for any institution entering the stablecoin issuance or settlement layer will be absolute. The structural risk for institutions running on old-spec compliance engines is no longer theoretical. It is priced at $1.96 billion.