WASHINGTON — Bank of America has admitted that it willfully violated the Bank Secrecy Act, and on Tuesday the Treasury Department said the bank will pay more than $1.21 billion after failing to report over $5 billion in suspicious transactions, including activity Treasury linked to Chinese money-laundering networks and the southwest border.
Treasury imposed three penalties on the country’s second-largest bank, a lender with more than 70 million clients, according to NBC News: $1.2 billion from the Financial Crimes Enforcement Network, $750 million from the Comptroller of the Currency, the largest in that office’s history, and an $11.6 million settlement with the Office of Foreign Assets Control over 475 apparent sanctions violations. Treasury called the total the third-largest penalty in its history. It is the latest action against Bank of America, and the date inside the release matters more than the sum.
Treasury says the bank still failed to escalate suspicious activity more than a year after the comptroller’s December 2024 cease-and-desist order over its anti-money-laundering and sanctions programs. The numbers also do not add up on their face: $1.2 billion, $750 million and $11.6 million come to about $1.96 billion, against a stated total of more than $1.21 billion, which fits only if the comptroller’s penalty is counted inside the FinCEN amount. The release as reviewed does not say so.
The bank admitted that it failed to maintain an anti-money-laundering program meeting the minimum legal requirements, failed to conduct due diligence on correspondent accounts for foreign financial institutions, and failed to file suspicious activity reports, Treasury said in its release. The causes it cites are blunt: the bank prioritized revenue and minimized compliance resources, leaned on law-enforcement inquiries and requests from other institutions instead of its own automated controls, let suspicious activity pile up uninvestigated, and gave its anti-money-laundering officer and key staff too little training. Customer due diligence did not account for how heavily some customers relied on payments from unknown third parties, and the audit function missed longstanding concerns.
More than $1 billion of the unreported transactions involved national security and other priority risks, including what Treasury calls Chinese money laundering networks, fraud, and trade-based money laundering with a substantial nexus to the southwest border. The comptroller found that the bank failed to properly monitor “trillions of dollars” in transactions, which produced late reports involving billions.
The sanctions side is smaller in dollars and wider in geography. The bank channeled correspondent payments through blocked banks, let designated individuals transact because its alerts were poorly calibrated, and was slow to update its watchlists, in apparent violation of US programs aimed at Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism. The Office of Foreign Assets Control judged the violations non-egregious and largely not voluntarily self-disclosed, and its settlement reflects no reduction for the bank’s remedial measures or cooperation.
The consent order requires a lookback with an outside party to find and report suspicious transactions the bank missed, plus independent reviews of its monitoring, customer due diligence, foreign correspondent due diligence and data governance. Those reviews are to focus on the southwest border, cartels and narcotics trafficking, Iran and Russia.
Treasury Secretary Scott Bessent said the actions “send a clear message that even the biggest financial institutions are not above the law.” Bank of America told NBC News that “financial crime compliance is serious, and we are responsible for getting it right,” that it has invested billions of dollars in technology and thousands of employees against financial crime, and that it files hundreds of thousands of suspicious activity reports a year. It reports third-quarter earnings on Wednesday morning.
The release gives no start or end date for the violations, so it is not clear how many of the missed reports predate the 2024 order.
