Introduction
Bank of America’s $1.2 billion penalty demonstrates how basic anti-money laundering (AML) failures can persist despite internal warnings, exposing even major banks to serious regulatory consequences.
Some of the failures concerned accounts held by the bank’s own foreign branches and affiliates. However, FinCEN treated these as correspondent accounts and found that Bank of America had failed to meet the applicable US due diligence requirements. [2] The OCC also found that a systemic gap in transaction monitoring led the bank to process potential trade-based money laundering transactions. [3]
Although primarily an AML and payments-monitoring case, the enforcement action has significant implications for correspondent banking and cross-border payment services and offers lessons for both correspondent and respondent institutions. Despite new payment platforms and settlement models, correspondent banking remains central to international payments. For many institutions in emerging markets, particularly in Africa, direct or indirect access to correspondent networks is essential.
Maintaining that access is a shared responsibility, dependent on transparency, due diligence and effective ongoing monitoring by every party in the payment chain. For African respondent banks and payment providers reliant on US dollar clearing, the lesson is clear: they must be able to show that their AML controls work before correspondent banks start raising questions or issuing requests for information (RFIs).
The Case at a Glance
On 13 October 2026, three US Treasury agencies announced enforcement actions against Bank of America. FinCEN imposed a $1.2 billion penalty, against which the OCC’s $750 million penalty was credited. [1][3] OFAC separately reached an $11.66 million settlement concerning 475 apparent sanctions violations. [4] Bank of America admitted wilfully violating the Bank Secrecy Act in its resolution with FinCEN, in the civil sense of reckless disregard or wilful blindness. [2]
What Failed—and What Banks Should Learn
1. Customer Risk Assessment and Due Diligence
What failed?
Bank of America applied simplified due diligence to correspondent accounts for its own foreign branches and affiliates, without recognising the nested activity passing through them. Separately, one platform stayed rated “Standard” despite years of alerts until a grand jury subpoena arrived, and suspicious activity reports (SARs) generally did not lead to meaningful reassessment. Reviews also omitted money-order activity and third-party payments. [2]
Why it matters
Reviews add little unless their findings feed into risk ratings and monitoring. At Bank of America, they did not. Until late 2024, files on its foreign branches and affiliates lacked the accounts’ purpose and expected activity, described the business only as “treasury services” or similar, and relied on branch risk assessments that were several years old. The bank did not understand that the affiliates served more than 250 non-bank financial institutions, including money services businesses (MSBs), whose payments did not match the interbank flows it had assumed. [2]
Recommended action
Ask and verify rather than assume:
Overall: Do our risk ratings change when our own data changes, or only when a subpoena arrives?
Beyond the group:
- Is disclosure of nested relationships a contractual requirement, at onboarding and whenever they change?
- Have we verified those declarations against actual payment flows?
Within the group:
- Do we review foreign branches and affiliates on a risk basis, with triggers such as rising volumes, new non-bank clients or new markets?
- Do we update their risk profiles and monitoring when the findings change?
2. Transaction Monitoring
What failed?
Between 2020 and 2025, two online vehicle auction platforms received about 220,000 suspicious groups of money orders worth over $660 million, many in sequential sets just below the $3,000 US identification threshold. Nearly $1 billion in wires involving Georgia, Belarus and other Commonwealth of Independent States (CIS) countries was reported late or inaccurately; one exporter expecting $1–4 million a year received hundreds of millions. [2]
Bank of America is not alone: the FCA fined Ghana International Bank £5.83 million in 2022 for relying largely on manual review above a single £20,000 threshold, [6] and HSBC £63.9 million in 2021 for untested monitoring scenarios, parameters and data. [7]
Why it matters
Transaction monitoring is an essential control in cross-border payments, where visibility is limited. Open-account arrangements make up around 80% of international trade, exposing correspondent banks and payment providers to TBML and sanctions risks as payments pass through several institutions and jurisdictions. [5] ISO 20022 pacs.008 data identifies payment parties, but not necessarily the source of funds, the underlying purchaser or the economic purpose.
At Bank of America, internal testing repeatedly flagged problems, yet its core threshold remained unchanged until regulators intervened. [2]
Recommended action
A correspondent or respondent bank should be able to answer five questions:
- Do we monitor linked payments across products for patterns in values, counterparties and geography, not just single transactions?
- Are our thresholds based on customer profiles and risk, and tested to detect what they should?
- If a correspondent’s RFI arrived today, could we answer it from the risk-relevant information we already hold on the remitter and customer?
- Would we spot unfamiliar originators, volumes beyond declared business, payers that are banks or MSBs, or new high-risk jurisdictions?
- When testing or reviews flag a problem, who acts on it, and how quickly?
Technology helps only with transparent payment data and human oversight that acts on what systems find.
3. Escalation, Reporting and Remediation
What failed?
Ad hoc suppression rules affected about 150,000 alert groups. The bank’s 2022 validation found suppressed risk factors linked to SAR filings in up to 58% of cases, yet the logic remained until December 2023, after regulatory engagement. Compliance’s 2022 recommendation to close a platform’s accounts was replaced by a mitigation plan, yet third-party payments continued until June 2025. [2]
Why it matters
The weaknesses were identified internally; the failure was in acting on them.
Recommended action
A correspondent or respondent bank should be able to answer two questions:
- Do we keep an inventory of suppression rules, with owners, approvals and periodic testing?
- When compliance recommends remediation or an exit, does the action have an owner, a deadline and evidence that it worked?
4. Sanctions Screening and Third-Party Oversight
What failed?
OFAC’s separate settlement found that a vendor error left Bank of America’s watchlist outdated for five weeks in 2023, discovered only when another US bank blocked a payment. A vendor routing directory still listed blocked banks, exact name and date-of-birth matches were ranked low priority, and some alerts were wrongly cleared or automatically released. [4]
Why it matters
As OFAC noted, an institution remains responsible for its own compliance even when it relies on third-party providers. [4]
Recommended action
A correspondent or respondent bank should be able to answer five questions:
- Which sanctions lists are we required or committed to screen against, and why?
- How quickly do official list changes go live in our screening system?
- How do we know every record, including payment routing data, loaded correctly?
- Were existing customers and connected parties rescreened?
- Can we evidence that our provider’s controls worked?
Conclusion
None of these failures needed a sophisticated scheme. They were ordinary control gaps, many flagged internally and left unresolved. The questions above are a practical test. A respondent that can answer them with evidence is one a correspondent can keep banking; a correspondent that asks them, of its respondents and of its own affiliates, is better placed to act before a regulator does.
References
[1] FinCEN, “FinCEN Assesses $1.2 Billion Penalty against Bank of America”, press release, 13 October 2026. https://www.fincen.gov/news/news-releases/fincen-assesses-12-billion-penalty-against-bank-america
[2] FinCEN, In the Matter of Bank of America, N.A., Consent Order Imposing Civil Money Penalty, No. 2026-03. https://www.fincen.gov/system/files/2026-10/BoA-Consent-Order-Execution-Final.pdf
[3] OCC, “OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance”, News Release 2026-89, 13 October 2026. https://occ.gov/news-issuances/news-releases/2026/nr-occ-2026-89.html
[4] OFAC, “Bank of America, N.A. Settles with OFAC for $11,662,930 Related to Apparent Violations of Multiple Sanctions Programs”, Enforcement Release, 13 October 2026. https://ofac.treasury.gov/media/937231/download
[5] The Wolfsberg Group, ICC and BAFT, Trade Finance Principles (2019 amendments), Sections 1.6 and 6. https://iccwbo.org/wp-content/uploads/sites/3/2019/03/trade-finance-principles-2019-amendments-wolfsberg-icc-baft-final.pdf
[6] FCA, Decision Notice: Ghana International Bank Plc, 23 June 2022. https://www.fca.org.uk/publication/decision-notices/ghana-international-bank-plc.pdf
[7] FCA, “FCA fines HSBC Bank plc £63.9 million for deficient transaction monitoring controls”, press release, 17 December 2021. https://www.fca.org.uk/news/press-releases/fca-fines-hsbc-bank-plc-deficient-transaction-monitoring-controls