Bank of America’s $1.2 Billion Fine Exposes a Failure Regulators Already Flagged

Bank of America failed to report more than $5 billion in suspicious transactions. On Tuesday, federal regulators made that failure expensive.

The Treasury Department announced more than $1.2 billion in penalties against the bank for violations of anti-money laundering and sanctions laws. The Financial Crimes Enforcement Network, or FinCEN, assessed a $1.2 billion penalty. Treasury called it the third-largest penalty in the department’s history.

The Office of the Comptroller of the Currency added a $750 million civil money penalty for a deficient and ineffective anti-money-laundering program. That penalty counts within the broader enforcement action and is the largest in the OCC’s history.

The scale alone is striking. But the more troubling detail is older.

A warning already on record

In December 2024, the OCC issued a cease-and-desist order requiring Bank of America to fix compliance problems. On Tuesday, the agency said the bank had not done so.

That matters. A consent order is not a suggestion. It is a regulator saying, in formal terms, that a bank must change how it operates. The new penalty suggests that the change did not happen fast enough, or deeply enough.

Treasury said Bank of America admitted it willfully violated the Bank Secrecy Act. The bank admitted it failed to maintain a compliant anti-money-laundering program, conduct required due diligence on foreign correspondent accounts, and file suspicious activity reports.

The alleged conduct stretched from 2018 through 2025. Treasury said the bank did not timely report more than $5 billion in suspicious transactions. More than $1 billion of that activity involved national security and other priority illicit-finance risks, including Chinese money-laundering networks and potential trade-based money laundering connected to the southwest border.

Some failures may have been human error. Treasury described others as systemic gaps. The bank at times did not make even basic efforts to investigate suspicious activity, according to regulators.

The precedent is uncomfortable

This case recalls TD Bank’s 2024 settlement. TD agreed to pay about $1.3 billion to FinCEN after authorities found serious failures in its anti-money-laundering controls. The Bank of America penalty is slightly smaller, but it follows a similar pattern: a large bank, weak controls, unreported suspicious activity, and a regulator forced to use money to make the point.

The pattern also recalls Binance. In 2023, FinCEN imposed a $3.4 billion penalty on the crypto exchange. That case involved a different kind of financial firm and a different set of controls. But the underlying question was the same: whether a financial institution had built systems capable of seeing illicit money before it moved through the system.

Bank of America is not Binance. It is the second-largest bank in the United States, and it processed more than $9 trillion in transactions last year, according to Treasury and public reporting.

That scale changes the problem. A small institution can fail because it lacks staff, technology, or expertise. A bank moving trillions of dollars has fewer excuses for not knowing where its controls break down. The volume is enormous, yes. But volume is the business model.

The precedent holds in one way: regulators have shown they will impose large penalties when anti-money-laundering systems fail at scale. It breaks in another: Bank of America had already received a formal order to correct related problems. This was not the first alarm.

What the bank says

Bank of America said the penalty will hurt its third-quarter earnings. The bank said its results, due Wednesday, would include a non-tax-deductible charge of $1.2 billion, reducing quarterly net income by about 17 cents a share.

That is a real cost. It is also a cost the bank can absorb in a way many companies cannot. The more lasting question is operational, not accounting.

Under the FinCEN order, Bank of America must hire an independent third party to review past transactions. That reviewer must identify suspicious activity the bank failed to detect and report those transactions to FinCEN.

That means the story may not end with Tuesday’s announcement. A backward-looking review can surface more reporting failures. It can also test whether the bank’s monitoring systems missed activity that regulators consider important.

Why investors should care

A fine of this size can affect investor confidence. It raises questions about management control, compliance spending, and the risk of further enforcement. Those questions do not resolve with one earnings charge.

The concern is not that Bank of America lacks money. It is that a bank of this size allowed known weaknesses to persist after regulators had already demanded change. Treasury said the bank sometimes relied on outside inquiries from law enforcement or other financial institutions to identify suspicious activity rather than catching it through its own systems.

That is a governance problem. Compliance teams can flag concerns. Systems can generate alerts. But if alerts pile up, investigations stall, and reports arrive late, the control framework exists mostly on paper.

Treasury said that in many instances, suspicious activity reports took more than six months to file, when they were filed at all. Late reports have limited value to law enforcement.

What could come next

The immediate next test is Bank of America’s quarterly results and its explanation of the charge. Beyond that, the independent review required by FinCEN could determine whether regulators believe the bank has finally addressed the problem.

The OCC will also watch whether the bank meets the terms of its compliance obligations. If it does not, the precedent from this week suggests regulators may not stop at another penalty. They could push for tighter oversight, more external review, or changes in how the bank manages financial-crime risk.

For the banking sector, the lesson is blunt. Anti-money-laundering compliance is not a back-office expense to be minimized. It is part of the license to operate at scale.

A $1.2 billion penalty gets attention. The fact that it followed a prior order to fix the same kind of failure should get more.