Bank of America must pay more than $1.21 billion in penalties for violating anti-money laundering and sanctions laws, the Treasury Department announced Tuesday.

Within that amount, a $1.2 billion fine levied by the Financial Crimes Enforcement Network is the third-largest in Treasury history. The Office of the Comptroller of the Currency concurrently assessed a $750 million civil monetary penalty – the largest in its 163-year history – over a “deficient and ineffective” compliance program.

The Office of Foreign Assets Control also announced an $11.6 million settlement with Bank of America over sanctions violations tied to Iran, Russia, global terrorism and narcotics.

The Treasury credited the OCC’s penalty toward its $1.2 billion fine. No asset cap was imposed.

Charlotte, North Carolina-based Bank of America admitted to willful violations of the Bank Secrecy Act, FinCEN said. The bank admits it failed to implement and maintain an AML program that satisfied the BSA and FinCEN’s implementing regulations, and that it failed to conduct due diligence for correspondent accounts for foreign financial institutions.

The bank also failed to file suspicious activity reports for $5 billion in transactions, FinCEN found.

Bank of America failed to properly monitor trillions of dollars in transactions, and “knew for years that it was failing to escalate potentially suspicious activities to investigators for review,” the OCC said.

Additionally, the bank’s BSA officer and staff “lacked sufficient skills and expertise” to effectively manage the bank’s BSA/AML program, according to the regulator.

“Financial institutions are on the front lines of protecting our economic and national security,” Treasury Secretary Scott Bessent said in a prepared statement. “When a bank of this size fails to meet its anti-money laundering and sanctions obligations, the consequences extend far beyond its own walls, exposing the entire U.S. financial system to significant illicit finance risks.”

Bank of America agreed to a cease-and-desist order in 2024 related to BSA/AML deficiencies. But the lender failed to complete steps needed to establish an effective BSA/AML compliance program after the order, and its program continues to have significant issues, the OCC said.

More than a year after the initial order, Bank of America didn’t escalate potentially suspicious activity for review, and it processed potential trade-based money laundering transactions because of a flaw in its transaction monitoring program, the OCC said.

“Almost two years ago, the bank signed an order with the OCC and committed to fixing its longstanding BSA deficiencies,” Comptroller of the Currency Jonathan Gould said in a statement. “Despite its obligation to the American people as a national-chartered, global systemically important bank, the bank’s BSA/AML compliance program continues to reflect widespread breakdowns in internal controls, which threatens U.S. national and economic security.”

“The bank’s poor response to its BSA deficiencies is unacceptable,” Gould said. “The second largest bank’s egregious and continued BSA violations warrant the OCC imposing its largest (civil money penalty) ever assessed against a bank. The OCC expects all banks to have an effective BSA/AML compliance program. Those that do not can expect swift and significant action.”

Bank of America is confident “we’re on the course,” CEO Brian Moynihan said during the bank’s third-quarter earnings call Wednesday.

“At the end of the day, I think we have agreed to call this a settlement and move forward,” the CEO said. “We’ll complete it and it is the focus of management to get it cleaned up.”

He indicated the bank sought to understand what Trump-era regulators expected, as they’ve pursued an overhaul of anti-money laundering rules. 

“The key was to get agreement to what the resolution was,” he said. “We went back and forth on that a little bit earlier in the year, and now (there’s) clarity as to exactly what the metrics, etc., they want to see. We file a lot of SARs, etc. and we just had to be clear about what the metrics they were looking for under a new regime that modified the programs, and we’re all set.”

The bank is taking its non-tax-deductible $1.2 billion charge in the third quarter. Despite the charge, Bank of America reported $11.6 billion in revenue for the third quarter and $6.9 billion in profit. The penalty shaved roughly 17 cents per share off the latter figure, the bank said.

Bank of America shares on Wednesday began trading 7.7% lower than they had before the penalty was announced, according to Yahoo Finance. By Bloomberg’s calculation, the penalty cost the bank $22 billion in stock value in the short term.

BofA ‘committed to completing’ work

A Bank of America spokesperson Tuesday cited billions of dollars the company has invested in technology and personnel to thwart financial crime.

“Financial crime compliance is serious, and we are responsible for getting it right,” the spokesperson said in an email to Banking Dive. “[O]ur team is far along with and committed to completing the work required to address the issues raised by our regulators.”

BofA CFO Alastair Borthwick, during a media call Wednesday, said the bank has added thousands of people in BSA/AML roles and trained them as the lender has worked through its issues in recent years.

“We feel like we're meeting all of the obligations in that consent order at this point,” he said. “We don't need, necessarily, to add any more people, and if we decided we did, we have lots of different positions that we can move people within the company.”

As for the timing of the announcement, Borthwick pointed to the bank’s 2024 order and said it “takes some period of time for the OCC to conclude their work before they establish a report and before they figure out what is the appropriate result of that report.”  

The CFO declined to speculate when the order might be lifted or identify the share of the work that’s been completed, but said “we feel like a substantial amount” is done.

“We've moved quickly to address everything we need to do,” Borthwick said. We've completed a lot of the work required in that consent order, and we've made substantial investments in our program, as in people and in technology.” 

‘Significant problems’

The fact that regulators did not impose an asset cap on BofA drew the ire of Sen. Elizabeth Warren, D-MA. 

“Slap-on-the-wrist fines have become the cost of doing business on Wall Street and are no deterrent,” she said in a statement Wednesday. “Big banks should be subject to structural punishments, and their executives should be held personally accountable when they break the law.”

FinCEN’s investigation revealed deficiencies related to the bank’s suspicious transaction identification and reporting and customer due diligence processes. As issues arose, Bank of America “prioritized its revenues and minimized the impact on its required compliance resources,” the Treasury Department said.

The bank’s resulting reliance on law enforcement inquiries and requests by other banks instead of its own internal controls to flag suspicious activity meant BofA “effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations,” Treasury said.

Bank of America also let suspicious activity accumulate uninvestigated for extended periods, which led to late reporting to law enforcement, regulators said.

The bank maintained that approach even as testing highlighted “significant problems,” the Treasury Department said. The bank didn’t quickly respond to “mounting red flags” involving payments from unknown third parties – including potential ties to narcotics trafficking proceeds – even when compliance employees escalated their concerns.

FinCEN’s consent order requires the bank to employ a third party to conduct a review to flag suspicious transactions that went undetected. The bank must undergo an independent review to determine the effectiveness of its suspicious activity monitoring, customer due diligence and foreign correspondent account due diligence programs, and its data governance framework related to information used in its AML program.

The bank’s settlement with OFAC relates to 475 apparent violations of sanctions programs, Treasury said. 

Bank of America “channeled correspondent banking payments through blocked banks due to technical and human error, allowed designated individuals to make payments and withdraw funds due to poor sanctions alert calibration, failed to promptly update watchlists following OFAC designations, and mishandled business accounts associated with blocked persons due to human error.”   

The bank has made “significant compliance commitments” involving training, testing and audit, and future communication and cooperation with OFAC, as part of the settlement, the Treasury release said.