The AML Supervisor Is Coming for the Megabank

On October 13, the U.S. Department of the Treasury announced coordinated enforcement against Bank of America, the nation’s second-largest bank by assets, for anti-money-laundering and sanctions failures. Treasury said the actions impose more than $1.21 billion in penalties—the third-largest penalty in Treasury history and the largest civil money penalty the Office of the Comptroller of the Currency has ever assessed.

The package is deliberately multi-agency. The Financial Crimes Enforcement Network assessed a $1.2 billion penalty after the bank admitted willful Bank Secrecy Act violations and failures in customer due diligence and suspicious-activity reporting. The OCC levied a $750 million civil money penalty for a deficient BSA/AML program that, according to the agency, failed to monitor trillions of dollars in transactions and produced late suspicious activity reports. The Office of Foreign Assets Control settled 475 apparent sanctions violations for $11.6 million, covering programs tied to Iran, Russia, narcotics trafficking, and terrorism, among others.

Separate market reporting says Bank of America disclosed a roughly $1.2 billion third-quarter charge tied to the matter—on the order of 17 cents per share—ahead of its earnings release. That pairing matters: the public record now links supervisory findings to a booked reserve, not only to consent orders filed after the close.

What supervisors say broke

FinCEN’s narrative centers on detection and reporting, not a single rogue desk. The bank admits it failed to maintain an AML program meeting minimum BSA requirements, fell short on correspondent-account due diligence, and did not file timely suspicious activity reports. Treasury says Bank of America failed to report more than $5 billion in suspicious transactions, including more than $1 billion tied to priority national-security risks—Chinese money laundering networks, fraud, and activity with a substantial nexus to the southwest border.

The consent order also describes process failure at scale: compliance staff escalated trade-based money laundering and narcotics-tied red flags, yet suspicious activity piled up uninvestigated; the bank leaned on law enforcement inquiries and peer-bank referrals instead of its own monitoring; and testing flagged problems that management did not fix. FinCEN requires a third-party lookback, independent reviews of monitoring and customer due diligence, and a data-governance review feeding the AML program.

The OCC’s order stresses continuity of breakdown. Bank of America remained under a December 2024 cease-and-desist requiring BSA/AML remediation, yet examiners say it still failed to escalate potentially suspicious activity more than a year later and processed potential trade-based money laundering through a systemic monitoring gap. Management, in OCC’s account, minimized those deficiencies while the transaction-monitoring stack generated large volumes of late SARs.

OFAC’s slice is smaller in dollars but sharp in optics: blocked-bank routing errors, miscalibrated alerts, stale watchlists, and mishandled accounts let millions of dollars move in apparent violation of multiple sanctions programs. Treasury classified the conduct as largely non-egregious but noted no mitigation for cooperation or remediation in the settlement amount.

Supervision, not just plumbing

Recent Culled coverage has tracked how U.S. enforcement reaches correspondent accounts, settlement rails, and wallet addresses—the machinery that moves value once a name is already sanctioned. The Bank of America case sits one layer up: prudential and AML supervisors punishing program design, staffing, and escalation inside a U.S. charter holder. Readers who followed sanctions moving into the payment plumbing should read this action as the mirror image—less about adding a new SDN entry, more about whether a megabank’s internal controls can carry the weight of those plumbing rules day to day.

That distinction also separates this story from institutional-history pieces such as how post-9/11 architecture outlived the war on terror. The legal scaffolding for AML and sanctions is decades old; what changed this week is the visible price tag on failure at a bank that prints trading and wealth-management revenue at scale.

The test for investors is not whether compliance exists on a org chart. It is whether missed SARs and sanctions slips show up in guidance when supervisors coordinate.

How to read the earnings line without over-reading the sector

Treasury’s release is about one institution’s admitted failures and tailored remedial orders. It does not, by itself, prove that every large U.S. bank faces nine-figure penalties next quarter. The fair inference is narrower: when FinCEN, the OCC, and OFAC align, compliance risk can migrate from footnote to P&L quickly—especially where examiners document willful BSA violations, repeat orders, and national-security-tied transaction backlogs.

For Bank of America specifically, the open questions are operational, not rhetorical. Can the mandated lookback and independent reviews close the monitoring gaps without disrupting legitimate payments? Will trading and investment-banking revenue this quarter absorb a ~$1.2 billion charge and still meet the street’s growth story? Secretary Scott Bessent’s statement frames the stakes in systemic terms—“even the biggest financial institutions are not above the law”—but the market will grade the bank on whether remediation spending buys a clean exam cycle.

Until those reviews land, treat coordinated AML supervision the way you would a capital or credit shock: a binding constraint that can reprice the franchise faster than any single blacklist update.