{"id":440,"date":"2026-10-26T20:55:50","date_gmt":"2026-10-26T20:55:50","guid":{"rendered":"https:\/\/amlcorner.com\/?p=440"},"modified":"2026-10-26T21:04:14","modified_gmt":"2026-10-26T21:04:14","slug":"bank-of-america-what-can-banks-learn-from-the-aml-and-sanctions-enforcement-actions","status":"publish","type":"post","link":"https:\/\/amlcorner.com\/?p=440","title":{"rendered":"Bank of America: what can banks learn from the AML and sanctions enforcement actions?"},"content":{"rendered":"\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1672\" height=\"941\" src=\"https:\/\/amlcorner.com\/wp-content\/uploads\/2026\/10\/Banking-controls-under-the-magnifying-glass.png\" alt=\"Illustration of a bank and international payment networks under a magnifying glass.\" class=\"wp-image-442\" srcset=\"https:\/\/amlcorner.com\/wp-content\/uploads\/2026\/10\/Banking-controls-under-the-magnifying-glass.png 1672w, https:\/\/amlcorner.com\/wp-content\/uploads\/2026\/10\/Banking-controls-under-the-magnifying-glass-300x169.png 300w, https:\/\/amlcorner.com\/wp-content\/uploads\/2026\/10\/Banking-controls-under-the-magnifying-glass-1024x576.png 1024w, https:\/\/amlcorner.com\/wp-content\/uploads\/2026\/10\/Banking-controls-under-the-magnifying-glass-768x432.png 768w, https:\/\/amlcorner.com\/wp-content\/uploads\/2026\/10\/Banking-controls-under-the-magnifying-glass-1536x864.png 1536w, https:\/\/amlcorner.com\/wp-content\/uploads\/2026\/10\/Banking-controls-under-the-magnifying-glass-1280x720.png 1280w\" sizes=\"auto, (max-width: 1672px) 100vw, 1672px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">On 13 October 2026, US authorities announced coordinated enforcement actions against Bank of America for weaknesses in its anti-money laundering and sanctions controls.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">FinCEN assessed a $1.2 billion penalty, with the OCC\u2019s $750 million assessment credited against that amount. Separately, the bank agreed to pay approximately $11.66 million to settle its potential civil liability for apparent sanctions violations.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Although the amounts attract attention, the findings offer a more useful starting point for financial institutions: how effectively do their controls identify risks, escalate concerns and turn known weaknesses into lasting improvements?<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>AML: weaknesses in detection and follow-up<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As part of its resolution with FinCEN, Bank of America admitted to wilful violations of the Bank Secrecy Act. These concerned its AML programme, due diligence on foreign financial institution correspondent accounts, and suspicious activity reporting.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Treasury highlighted several concerns:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Excessive reliance on law enforcement enquiries and referrals from other financial institutions to identify suspicious activity.<\/li>\n\n\n\n<li>Delays in investigating activity and submitting suspicious activity reports.<\/li>\n\n\n\n<li>Customer due diligence that did not adequately address payments from unknown third parties.<\/li>\n\n\n\n<li>Failure to respond meaningfully to escalating concerns about potential trade-based money laundering and fraud.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">According to Treasury, the bank failed to report more than $5 billion in suspicious transactions in a timely manner. This figure concerns suspicious activity; it should not be read as a finding that all those funds were proven proceeds of crime.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The OCC also identified shortcomings in staff expertise, training and independent testing. Its findings indicate that significant problems persisted after the December 2024 order, including failures to escalate potentially suspicious activity to investigators.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sanctions: screening must lead to effective action<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OFAC\u2019s settlement concerned 475 apparent violations. Its findings included:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Payments processed through blocked banks.<\/li>\n\n\n\n<li>Exact matches on both a customer\u2019s name and date of birth receiving insufficient priority.<\/li>\n\n\n\n<li>Delays in updating sanctions watchlists.<\/li>\n\n\n\n<li>Errors in handling accounts associated with blocked persons.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The payment failures included alerts incorrectly cleared by staff or automatically suppressed. OFAC classified the case as non-egregious, but most apparent violations were not voluntarily self-disclosed. The settlement received no reduction from the base penalty.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Lessons learnt: what should other banks do differently?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In our view, the findings highlight six practical lessons. These are considerations for other institutions when assessing their own controls, rather than a summary of the specific remediation requirements imposed on Bank of America.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>1. Test whether suspicious activity is detected and acted upon<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A monitoring system should be assessed on its ability to identify relevant suspicious activity and support timely investigation. The number of alerts generated or closed does not, by itself, demonstrate effectiveness.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Banks should test the full process: whether relevant transactions enter monitoring systems, whether scenarios identify the risks they are designed to detect, and whether alerts reach investigators and result in timely reporting where required. Cases first identified through law enforcement enquiries or referrals from other banks can help expose weaknesses in internal detection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2. Turn customer due diligence into decisions<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Customer information is useful only if it informs how the relationship is assessed and monitored. Unexplained third-party payments, activity inconsistent with the customer\u2019s business, or repeated concerns about trade transactions should prompt further assessment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Banks should establish who must investigate these concerns, what evidence is needed and when a decision must be made. Depending on the findings, action may include updating the customer\u2019s risk profile, obtaining further information, strengthening monitoring, considering restrictions or exit, and assessing reporting obligations. Recording a concern without resolving it leaves the underlying risk unaddressed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>3. Verify that sanctions updates are active in operational systems<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Receiving an updated sanctions list from a vendor is only one stage of implementation. Banks should verify that the update has loaded successfully into each relevant screening system and that newly designated parties can be detected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Controls should identify missing, delayed or failed updates, assign responsibility for resolving them and provide a contingency process. Where a gap occurs, the bank should assess affected customers and transactions, including whether a lookback is necessary. Reliance on a vendor does not remove the need to verify that the bank\u2019s controls are functioning.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>4. Challenge alert prioritisation, suppression and release decisions<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Screening effectiveness depends on what happens after a potential match is identified. Strong matches should receive appropriate priority, while decisions to suppress or clear alerts should be supported by a sound rationale.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Banks should test whether prioritisation rules reflect the strength of available identifiers and whether suppression rules remain appropriate after changes to sanctions lists or customer information. Quality assurance should also assess whether staff correctly handle blocked accounts and escalate uncertainty before releasing funds.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>5. Give management a clear view of unresolved exposure<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Management reporting should show where controls are failing and what those failures mean for the bank.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Useful measures include the age and risk of outstanding investigations, delays in reporting, failed list updates, recurring decision errors, monitoring coverage gaps and overdue remediation. These measures should support decisions about staffing, expertise, technology and interim controls. Where a significant weakness remains open, a named owner should be accountable for managing the exposure and escalating delays.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>6. Close remediation only when effectiveness is demonstrated<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Introducing a new procedure, delivering training or changing a system does not establish that the underlying weakness has been corrected.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Before closing an issue, banks should confirm that its root cause has been addressed, assess whether similar problems exist elsewhere and test the revised control over an appropriate period. Independent validation should challenge the evidence supporting closure. Where past activity may have been missed, remediation should also address the need for retrospective review and any resulting reporting or corrective action.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The central lesson is that identifying a weakness must lead to a timely, effective response. Banks need to demonstrate that concerns reach the right decision-makers, corrective action addresses the underlying cause, and testing confirms that the improvement lasts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sources: <a href=\"https:\/\/www.fincen.gov\/news\/news-releases\/fincen-assesses-12-billion-penalty-against-bank-america\">FinCEN announcement<\/a>, <a href=\"https:\/\/www.occ.gov\/news-issuances\/news-releases\/2026\/nr-occ-2026-89.html\">OCC announcement<\/a>, <a href=\"https:\/\/home.treasury.gov\/news\/press-releases\/sb0657\">Treasury announcement<\/a> and <a href=\"https:\/\/ofac.treasury.gov\/media\/937231\/download?inline=\">OFAC enforcement release<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>On 13 October 2026, US authorities announced coordinated enforcement actions against Bank of America for weaknesses in its anti-money laundering and sanctions controls. FinCEN assessed a $1.2 billion penalty, with the OCC\u2019s $750 million assessment credited against that amount. Separately, the bank agreed to pay approximately $11.66 million to settle its potential civil liability for [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3,12,4],"tags":[],"class_list":["post-440","post","type-post","status-publish","format-standard","hentry","category-aml","category-case-studies","category-sanctions"],"_links":{"self":[{"href":"https:\/\/amlcorner.com\/index.php?rest_route=\/wp\/v2\/posts\/440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/amlcorner.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/amlcorner.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/amlcorner.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/amlcorner.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=440"}],"version-history":[{"count":3,"href":"https:\/\/amlcorner.com\/index.php?rest_route=\/wp\/v2\/posts\/440\/revisions"}],"predecessor-version":[{"id":444,"href":"https:\/\/amlcorner.com\/index.php?rest_route=\/wp\/v2\/posts\/440\/revisions\/444"}],"wp:attachment":[{"href":"https:\/\/amlcorner.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/amlcorner.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/amlcorner.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}