Bank of America has been hit with more than $1.2 billion in US penalties after regulators said it failed for years to report suspicious transactions and fix long-standing weaknesses in its defences against money laundering.
The Treasury Department announced the action on Tuesday. It is among the largest enforcement actions of its kind against a US bank, and it hits the country’s second-largest lender at an awkward moment, just as earnings season begins.
What regulators found
Treasury said Bank of America did not properly monitor trillions of dollars in transactions and failed to report more than $5 billion in suspicious activity on time. More than $1 billion of that involved potential national security risks and other high-priority threats, including activity linked to Chinese money-laundering networks and suspected trade-based laundering connected to the US-Mexico border. Regulators also pointed to transactions possibly tied to drug trafficking and fraud.
The bank admitted that it wilfully violated the Bank Secrecy Act. Regulators said it did not maintain a compliant anti-money-laundering programme, did not adequately vet foreign correspondent accounts and did not file suspicious activity reports as required.
One finding stood out. Treasury said the bank relied so heavily on tips from law enforcement and other financial institutions that it effectively outsourced part of its duty to spot suspicious activity itself. Regulators also said it put revenue ahead of compliance resources, allowing suspicious activity to sit uninvestigated for long periods.
How the penalties break down
The package totals about $1.21 billion. The Financial Crimes Enforcement Network, known as FinCEN, assessed a civil penalty of $1.2 billion. A $750 million fine from the Office of the Comptroller of the Currency is credited towards that figure, and it is the largest penalty that agency has ever imposed. A separate sanctions settlement of $11.6 million brings the total to just over $1.21 billion.
Because the amounts overlap, the headline figure should not be read as several separate $1 billion fines.
A second chance that was not taken
The action did not come out of nowhere. In December 2024 the bank agreed to a cease-and-desist order requiring it to fix its anti-money-laundering controls. Regulators said they found late suspicious activity reports and unresolved problems in how the bank assessed its customers.
According to the latest findings, serious problems continued. More than a year after the order, potentially suspicious transactions were still failing to reach the investigators who decide whether federal reports are needed. Comptroller of the Currency Jonathan Gould called the bank’s response unacceptable. Treasury Secretary Scott Bessent said no institution is above the law.
What the bank must now do
Under a consent order, Bank of America must hire an independent consultant to review past transactions back to January 2022 and identify suspicious activity that went undetected. Anything that should have been reported must be sent to federal authorities. The bank must also submit to independent assessments of its transaction monitoring and customer due diligence. One report suggested the outside review could run into 2028.
The bank said it has worked with regulators for years, is committed to finishing the work required and has continued to invest in compliance. It expects a $1.2 billion charge in its third-quarter results. The charge is not tax-deductible and will reduce net income by about 17 cents a share.
Market reaction and wider pressure
Shares fell more than 1.5% in premarket trading on Wednesday. The case lands less than a week after federal regulators fined American Express $350 million over similar failures to detect and report suspected money laundering. Together the cases suggest regulators are keeping up pressure on large financial institutions.
A caution is worthwhile. A suspicious activity report is an investigative lead, not proof of a crime, and the figures describe gaps in monitoring rather than confirmed criminal proceeds.
What to watch
Investors will look for more detail when the bank reports earnings, including whether compliance spending rises and whether regulators place any limits on growth. The independent review could also surface further reportable transactions in the coming years.
For the wider industry, the message is plain. Regulators expect banks to detect suspicious activity themselves, and a promise to fix weaknesses carries little weight unless the fixes work.
