Bank Of America Fined $1.2 Billion For Failing To Report $5 Billion In Suspicious Transactions, Including Chinese Money-Laundering Networks
Most banks spend the night before their earnings call polishing the NII slide and fudging the reserve release calculations. Bank of America will be spending it reading a Treasury press release about itself.
Just after the close on Tuesday, Treasury announced more than $1.21 billion in penalties against BofA for violating anti-money-laundering and sanctions laws. Treasury calls it the third-largest penalty in its history, and the OCC calls its piece the largest it has ever handed out. The bank admitted it willfully violated the Bank Secrecy Act. It did not report more than $5 billion in suspicious transactions on time, and more than $1 billion of that was tied to what Treasury calls "priority" national-security risks, including Chinese money-laundering networks and illicit finance along the southwest border.
Here is how the money breaks down, per Treasury's press release:
The Financial Crimes Enforcement Network (FinCEN) assessed a $1.2 billion penalty for the Bank's failure to mitigate and report priority national security risks, including Chinese Money Laundering Networks and illicit finance along the southwest border.
The OCC assessed a $750 million civil money penalty for the Bank's deficient and ineffective BSA/AML (anti-money laundering) compliance program.
The Office of Foreign Assets Control (OFAC) announced an $11.6 million settlement agreement with the Bank over apparent violations of numerous sanctions programs, including on Iran, Russia, narcotics, and global terrorism.
The penalties don't simply add up. Per CNBC, the OCC's $750 million is credited toward FinCEN's $1.2 billion, which gets you to about $1.21 billion once OFAC's change is added. In other words, it is a $1.2 billion fine with a record attached.
"Prioritized Its Revenues"
The details are where it gets awkward. Treasury did not say BofA was simply overwhelmed. It said this:
As these issues arose, Bank of America prioritized its revenues and minimized the impact on its required compliance resources. The nature and extent of the Bank's resulting reliance on law enforcement inquiries, requests by other financial institutions, and similar interventions over its own internal, automated controls... meant that the Bank effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations.
Translation: BofA's money-laundering detection system often amounted to waiting for a subpoena.
Treasury also says the bank "allowed suspicious activity to accumulate uninvestigated for extended periods." That meant SARs arrived too late to help law enforcement much. Its customer due diligence also "failed to account for customers' extensive reliance on payments from unknown third parties," and the bank didn't act on red flags that included "potential ties to narcotics trafficking proceeds," even after its own compliance staff raised concerns about trade-based money laundering and fraud.
The OCC's language was harsher. Its release says the bank's transaction monitoring "resulted in the Bank failing to properly monitor trillions of dollars in transactions," that "the Bank knew for years" it was failing to escalate potentially suspicious activity, and that its BSA Officer and staff "lacked sufficient skills and expertise." Comptroller Jonathan Gould said:
"The second largest bank's egregious and continued BSA violations warrant the OCC imposing its largest [civil money penalty] ever assessed against a bank."
— Comptroller Jonathan Gould (@USComptroller) October 13, 2026
OFAC, for its part, found 475 apparent sanctions violations. They included payments routed through blocked banks and designated individuals who were allowed to withdraw funds "due to poor sanctions alert calibration." OFAC called the violations "non-egregious," which is the regulatory version of "could have been worse."
About That 2024 Order
None of this came out of nowhere. On December 23, 2024, the OCC issued a cease-and-desist order against BofA for BSA and sanctions deficiencies, "including a failure to timely file suspicious activity reports and failure to correct a previously identified deficiency related to its Customer Due Diligence processes." The order itself described a "systemic failure" to set proper transaction-monitoring thresholds. That order came with no fine, a point American Banker noted at the time. As we reported back in October 2024 (Oct 30, 2024), barely two weeks after TD's guilty plea, BofA disclosed in a filing that it was in talks with several federal regulators over its
Bank Secrecy Act/anti-money laundering and sanctions compliance programs... including transaction monitoring, training, governance, and customer due diligence... resolution of these discussions may include one or more public orders by the regulators.
At the time we wondered which of the big US banks would be "named next" after TD. It took two years and an extra cease-and-desist, but we can now cross that question off the list.
(The same filing also disclosed a separate CFPB inquiry into payments on the Zelle network, which BofA said it might fight in court. Nothing in today's Treasury, OCC or OFAC releases mentions Zelle. That was a different matter with a different regulator.)
This time there is a fine, and the reason is what happened afterward. Per Treasury:
After agreeing to the 2024 Order, the Bank still failed to prioritize BSA/AML compliance... For example, more than a year after the 2024 Order, the Bank still failed to escalate potentially suspicious activities to investigators for review.
Put differently, the first notice was free. The follow-up came with a bill.
The TD Comparison
The obvious benchmark is TD Bank. In October 2024 TD pleaded guilty to BSA and money-laundering conspiracy charges and agreed to roughly $3 billion in total penalties across agencies, according to the DOJ. That included a $1.8 billion criminal resolution, a $450 million OCC penalty, and an asset cap on its US operations. We flagged back in May 2024 that the AML mess risked sending TD into a "lost decade."
BofA's settlement differs in a few important ways:
- About 40% of TD's total: $1.2 billion versus about $3 billion.
- Admission, not a plea: BofA admitted willful BSA violations to FinCEN. No source we've seen mentions criminal charges or a DOJ resolution.
- No asset cap: Instead of a growth restriction, BofA gets a third-party lookback and independent reviews of its monitoring, CDD and correspondent-banking due diligence. Those reviews focus on the southwest border and cartels, Iran and Russia.
- OCC records: BofA's $750 million beats TD's $450 million OCC penalty by a wide margin.
In other words, a record fine, but nothing like TD's sentence.
Some Napkin Math
BofA told CNBC the penalties mean a $1.2 billion non-tax-deductible charge in Q3 results (perfect timing for tomorrow's Adjusted EPS to miss net of "one time almost criminal items", cutting net income by about 17 cents per share. Against the roughly $1.11 consensus EPS, that is about 15% of the quarter's expected earnings gone before the call starts.
Another way to measure it: $1.2 billion against "over $5 billion" in suspicious transactions not reported on time works out to about 24 cents per unreported dollar. As compliance budgets go, the cheaper option was always going to be the compliance budget.
The bank says remediation costs are "already reflected in its current expense base," so the hit should be one-time, at least on paper.
The Stock
The timing was unusual. BAC closed Tuesday at $53.94, down 1.2% in concert with a broader bank selloff (after what were good, if not great earnings by JPM, Citi and Goldman) but the news came out around 4:09pm ET, right after the bell. In other words, regular-session weakness came alongside a soft tape for financials and can't be pinned on the fine, and sure enough BofA sold off another 2% after hours once the news hit. That leaves BAC down about 3.6% YTD, and well below its 52-week high of $65.22.
TL/DR: the $1.2 billion is not the story. BofA can cover it with about a week of NII (6 days when the 10Y hits 6%); the story is that Treasury, the OCC and Bessent all used the same phrase about the second-largest US bank: it "prioritized its revenues" over compliance. And BofA kept doing so for more than a year after signing a cease-and-desist. For a CEO who has built his tenure on "responsible growth," that phrase will be hard to escape. The independent reviews and lookback will likely produce more late SARs, and possibly more findings, over the coming quarters.
Next catalysts:
- Q3 results, Wednesday before the open; call at 8:30am ET. Consensus is about $1.11 EPS on about $30.6–30.7 billion revenue, with FTE NII of about $16.55 billion (Zacks). BofA guided 2026 NII growth to the upper end of 6–8% in July. A Q3 NII print of $16.3 billion or more keeps that credible, per one preview.
- On the call, listen for whether management reports results excluding the 17-cent charge (it will). Also listen for any change to remediation spending or the expense outlook, whether more regulatory or DOJ exposure remains (a "no comment" will say a lot), whether buybacks are affected, and NII guidance after the September Fed move.
- Moynihan on CNBC at 10:20am ET, where "responsible growth" is likely to come up more than he'd like.
Going into the quarter, Goldman's desk said it wanted BofA to show "any NII upside updated for the rate curve and can this flow into operating leverage?" Operating leverage is easier to show without a $1.2 billion penalty line item.
Still, the main lesson for anyone thinking of skimping on AML: it costs about 24 cents on the dollar to make your (allegedly criminal) clients extra happy, and the bill eventually arrives.
Much more in the full Goldman Desk Bank/Fins EPS Preview note, available to pro subs.