It's 4:50 p.m. and someone just forwarded you the order. Subject line: "Have you seen this?" You haven't. You tell yourself you'll read it tonight, but you probably won’t. Most people won’t, because it’s a long document written by lawyers, and your real job is still waiting in your inbox.
It’s worth the time anyway. An enforcement order is the cheapest exam prep you'll ever get. A regulator just wrote down, in public, what it looks for and exactly where it didn’t find it.
On October 13, 2026, three U.S. regulators announced penalties against Bank of America, N.A. FinCEN and OCC jointly assessed $1.2 billion. OFAC settled for $11.6 million. The bank admitted it willfully broke anti-money laundering (AML) law.
Seven findings from the order
If you read nothing else, read this. Every number below comes from the order's own statement of facts.
- The risk weights barely moved. From 2018 to 2023, 76% of the weights in the bank's transaction monitoring system were never changed. Of the ones that were, about 80% were decreases. A system that never gets tuned slowly stops seeing things.
- Alerts got rescored and suppressed without enough testing. Rescoring logic touched about 150,000 event groups. Alerts that were automatically promoted drove more than a third of cases in several years, and close to half in 2023.
- The case threshold wasn't well supported. The bank lowered it from 20 points to 10 or 12 in December 2023, after talking with regulators. Its own estimate said that would add about 16,000 investigations a month and take roughly 750 more people.
- Warnings got ignored and testing looked at the wrong thing. Compliance and testing staff raised concerns repeatedly. Testing focused on how many alerts became suspicious activity reports (SARs), not on what the system missed. FinCEN said management focused on the impact to resourcing, not on fixing the problem.
- The lookbacks found billions. A lookback is a review of past activity to find what got missed. A 2023 lookback found nearly $4 billion in suspicious activity. One in 2024 found nearly 8,900 unfiled SARs tied to nearly $4 billion. FinCEN's total: over $5 billion missed or late, and over $1 billion of it tied to national security and other priority risks.
- Customer profiles didn't match the money moving. One customer was expected to have $1 million to $4 million in sales. It received hundreds of millions of dollars in wires from Eastern Europe. The bank closed those accounts in January 2024.
- Saving money was part of the story. FinCEN said the bank likely saved hundreds of millions of dollars in compliance costs, and gave that factor greater weight.
Why it matters now
A consent order means the bank admitted the facts and agreed to the penalty. It binds this one bank and isn’t a new rule, but you should still care, because the failures it names can live in any program. Here's who did what:
Agency | Who they are | What happened |
FinCEN | The Treasury bureau that enforces the Bank Secrecy Act (BSA), the main U.S. anti-money laundering law | $1.2 billion penalty. Three willful BSA violations |
OCC | The Office of the Comptroller of the Currency, which supervises national banks | $750 million penalty for a deficient BSA and anti-money laundering program |
OFAC | The Office of Foreign Assets Control, which runs U.S. sanctions | $11.6 million settlement over 475 apparent violations |
The three FinCEN violations are failing to keep an adequate anti-money laundering program, failing to do due diligence on correspondent accounts for foreign financial institutions, and failing to file SARs accurately and on time. The order covers at least January 1, 2018 through July 1, 2025.
“Willful” has a narrow meaning here. In civil BSA cases, the order says it means reckless disregard or willful blindness, not a plan to launder money. In plain terms, it means ignoring what you were told.
Where it usually goes wrong
It usually starts with a quiet Tuesday meeting.
Picture a team of six analysts and 400 alerts a week. The queue never empties, so someone suggests raising the threshold so fewer alerts fire. It sounds practical, and the backlog shrinks. Nobody writes down why that number was picked or what it might stop catching.
Three habits show up again and again in the order itself. The system gets built once and never tuned, and testing checks that the process ran instead of whether it caught the right things. Then, when someone raises a flag, the answer turns to capacity: “do we have the people?” instead of “do we have the risk?”
None of that feels like a failure in the moment because each piece feels like managing a workload. Stack up enough years of it and you get over $5 billion in missed or late reports. Most of the time, nobody decides to let a control slip.It just gets a little less attention each year, and the warnings get easier to wave off.
10 tests you can run this week
Each test comes straight from a failure the order names. Score yourself with the scale below, then write the date next to every gap. You can download a copy of these tests here.
Rating | What it means |
Pass | You ran the test, you have the evidence, and a stranger could repeat it and get your answer. |
Gap | You ran it and found a problem. |
Don't know | You haven't run it. Count it as a Gap until you do. |
# | Test | How to run it | A Pass looks like |
1 | Last tuning date | Pull the date each monitoring risk weight last changed | Every weight reviewed in the past 12 months, with a written reason |
2 | Direction of change | Count increases and decreases across your last two tuning rounds | Every decrease has evidence behind it |
3 | Threshold reason | Find the written reason for your alert threshold | One page showing the data behind the number and who approved it, not just headcount |
4 | Automation share | Calculate the share of cases created or closed by automatic rules | You know the number, sampled it last quarter, and no single rule drives most cases |
5 | Suppression rules | List every rule that lowers or hides an alert | Each was tested before launch and retested since |
6 | Below-the-line sample | Hand-review a sample of activity that fell under your threshold | Done in the past 12 months, and what you found fed back into tuning |
7 | Filing speed | Pull the days from alert to SAR filing for your last 20 SARs | Every one met the filing deadline in the SAR rule, and late ones have a documented cause |
8 | Profile versus reality | For your 20 biggest customers by wire volume, compare expected activity on file to the last 12 months | Gaps beyond your set tolerance triggered a documented review |
9 | Where findings go | Take your last three audit or testing findings | Each has an owner, a due date and proof it closed |
10 | Foreign correspondent files | Pull the files for accounts held for foreign financial institutions | Each has a current risk assessment and a stated reason for its activity level |
For test 8, use the order's own example as your yardstick. A customer expected to sell $1 million to $4 million that receives hundreds of millions in wires should never sit quietly in a queue.
What happens next
The penalties are only half of it…and the fixes are where the real work lives. Treasury's release says Bank of America must do the following under the FinCEN order:
Requirement | What it covers |
Third-party lookback | Find and report to FinCEN the suspicious transactions that went undetected |
Independent review | Suspicious activity monitoring, customer due diligence, foreign correspondent account due diligence and the data governance framework for AML information |
Priority risks to test against | The U.S. southwest border and cartels, Iran, and Russia |
OFAC commitments | Training, testing and audit, and future communication and cooperation with OFAC |
The OCC's penalty also sits on top of its December 2024 cease-and-desist order, which told the bank to fix its program. Treasury says the OCC found deficiencies still open more than a year after that order. Treasury also called the OCC penalty the largest in that agency's history.
So what should you watch for? Similar actions, and any guidance that follows. Treasury's release also says FinCEN is accepting whistleblower tips and that awards are possible when a case ends in penalties above $1 million.
The checklist is just the start
A checklist finds gaps, but unfortunately it won’t fix them for you.
The order is clear on this. People inside the bank saw the problems and said so, more than once. What they didn’t get was a yes. FinCEN wrote that management focused on the impact to resourcing instead of remediation, and that the bank likely saved hundreds of millions of dollars in compliance costs.
Fixing a threshold takes people, and people cost money. Most compliance teams have sat in that meeting where the honest answer was “we’d need more headcount” and the room went quiet.
So run the 10 tests, but don't stop at the score. Write each Gap down with a cost, a date and a name. Then put it in front of the person who can say yes. If they say no, put that in writing too. A documented no is hard to ignore later and an undocumented worry is easy to forget.
Start with one test
Pick one test from the table and run it before the end of the week. If you can't decide, start with number 3 and find the written reason for your alert threshold. Then write down what you find, even if what you find is nothing.
The views in this blog are my own, and should not be considered legal advice.
References
- FinCEN consent order in the matter of Bank of America, N.A. (PDF). Status: final enforcement action. Applies to: this bank only, though the failures apply to banks, money services businesses and other covered firms.
- FinCEN press release, October 13, 2026
- Treasury press release, October 13, 2026
- OCC news release 2026-89
- Authorities cited in the order: 31 U.S.C. 5318(h) and 31 CFR 1020.210 (AML program), 31 U.S.C. 5318(i) and 31 CFR 1010.610 (correspondent account due diligence), 31 U.S.C. 5318(g) and 31 CFR 1020.320 (SARs). OCC: 12 CFR 21.21 and 21.11.
