News Desk · Enforcement

OCC fines Bank of America $750 million over deficient BSA/AML compliance program

The Office of the Comptroller of the Currency (OCC) imposed a $750 million civil money penalty on Bank of America, N.A. The OCC says the bank's transaction monitoring failed to properly monitor trillions of dollars in transactions.

EnforcementUS13 Oct 20262 min read

On October 13, 2026, the Office of the Comptroller of the Currency (OCC), the US regulator of national banks, announced a $750 million civil money penalty against Bank of America, N.A. The OCC says the penalty is for violations of the Bank Secrecy Act (BSA) and its implementing regulations, including 12 CFR 21.21 and 12 CFR 21.11. The OCC says the amount is the largest in its history.

According to the OCC, the bank's BSA/AML compliance program was deficient and ineffective. The OCC says a deficient transaction monitoring system meant the bank did not properly monitor trillions of dollars in transactions, which led to many late suspicious activity reports (SARs) involving billions of dollars. The OCC also says the bank's BSA Officer and staff lacked sufficient skills and expertise, key personnel were not adequately trained, and the BSA audit function missed long-standing concerns that examiners later found.

The bank is already subject to a December 2024 cease-and-desist order from the OCC that requires it to address its deficient BSA/AML compliance program. The OCC says that since that order the bank has not completed many required steps, still failed to escalate potentially suspicious activity for investigation, and processed potential trade-based money laundering transactions because of a systemic gap in monitoring.

The OCC says the Financial Crimes Enforcement Network (FinCEN) is assessing a $1.2 billion penalty in coordination with the OCC action, and that FinCEN's penalty credits the OCC's $750 million penalty. The OCC penalty will be paid to the US Treasury.

Why it matters to AML professionals

Regulators judge an AML program by whether its monitoring actually covers the activity flowing through the bank, not by whether a system exists. An open cease-and-desist order raises the stakes: failing to finish required remediation can lead to a further penalty. AML professionals who own monitoring coverage, SAR timeliness or remediation tracking are closest to the issues regulators examine in cases like this.

Red flags in this case

If this landed in your queue

  1. Check whether the activity in the alert was in scope for monitoring, and escalate any coverage gap you find
  2. Record when the activity was first detected and track the case against the SAR filing deadline
  3. For trade-related payments, compare the payment against invoices, shipping documents and the customer's stated business
  4. Escalate cases tied to open remediation items so the compliance team can report progress accurately

What control failed

Transaction monitoring. The OCC says a deficient transaction monitoring system meant the bank did not properly monitor trillions of dollars in transactions, leading to many late SARs involving billions of dollars.

Key terms

Civil money penalty
A fine a regulator imposes for breaking laws or regulations, without a criminal case.
Cease-and-desist order
A regulator's order that requires a bank to stop unsafe practices and fix specific problems.
Trade-based money laundering
Moving value through trade deals, such as false invoices, to hide where money comes from.

Interview angle

How would you test whether a bank's transaction monitoring covers all the activity it should?

Explain mapping every product and transaction type to monitoring rules, reconciling source-system data to what the monitoring system receives, and checking alert-to-SAR timelines for delays.

Sources

Go deeper on AMLift

Found this useful? Share it with your network, or tell us if something looks wrong.

Every fact in AMLift News Desk stories comes from an official source: a regulator, court, government gazette or the company's own filing.