WASHINGTON — Federal regulators imposed more than $1.2 billion in penalties on Bank of America on Tuesday, citing failures to detect and report suspicious transactions that persisted after an earlier order to fix its safeguards.

As part of its settlement with the Financial Crimes Enforcement Network, the bank admitted willful violations of the Bank Secrecy Act. Those violations involved its anti-money-laundering program, scrutiny of foreign banks’ accounts and suspicious activity reporting.

The Treasury Department said Bank of America failed to report more than $5 billion in suspicious transactions on time. More than $1 billion involved national security concerns or other priority financial crime risks.

The action also requires an outside review of transactions the bank may have missed. That review could extend into 2028, keeping the bank under scrutiny long after Tuesday’s penalty announcement.

Regulators had already ordered the bank to fix its controls

The enforcement history stretches back well before the latest fine.

On Dec. 23, 2024, the Office of the Comptroller of the Currency issued a cease-and-desist order addressing Bank of America’s compliance failures. At the time, regulators identified late suspicious activity reports and an unresolved problem with how the bank assessed its customers.

The agency also cited weaknesses in management oversight, internal controls, independent testing and employee training. It required broad corrective action, including an independent assessment and reviews of past transactions.

In other words, the 2024 intervention already required the bank to investigate whether its systems had missed activity that should have reached federal authorities.

However, regulators said Tuesday that serious failures continued. More than a year after that order, potentially suspicious transactions still were not reaching investigators for review.

The OCC also found that key compliance personnel lacked sufficient expertise and training. Meanwhile, internal audits failed to uncover longstanding problems that government examiners subsequently identified.

According to the agency, management continued to minimize those deficiencies while the bank’s monitoring system failed to properly scrutinize trillions of dollars in transactions. That figure describes the scale of inadequate monitoring; it does not mean regulators identified trillions of dollars in criminal proceeds.

The Bank of America fine includes overlapping penalties

Three Treasury agencies announced coordinated actions, but their headline figures cannot simply be added together.

FinCEN assessed a $1.2 billion civil penalty. The OCC separately assessed $750 million, which FinCEN credits toward its total. As a result, the two assessments require $1.2 billion in combined payments, including $450 million under FinCEN’s payment instructions.

A separate sanctions settlement with the Office of Foreign Assets Control adds $11,662,930. Altogether, the announced financial obligations total approximately $1.212 billion.

The OCC described its $750 million assessment as the largest civil money penalty in the agency’s history. Treasury called the coordinated action its third-largest penalty.

Treasury says the bank relied too heavily on outside warnings

According to Treasury’s findings, Bank of America depended too heavily on inquiries from law enforcement and other financial institutions to identify suspicious activity.

Those outside warnings effectively substituted for parts of the bank’s own detection process, the department said. Meanwhile, questionable activity accumulated without investigation, reducing the usefulness of reports when they eventually reached authorities.

Treasury also said the bank prioritized revenue and limited the effect on compliance resources as problems emerged. Testing exposed weaknesses, yet meaningful corrective action did not follow.

Other concerns involved customers receiving payments from unidentified third parties. Compliance employees raised possible links to fraud, trade-based money laundering and drug proceeds, but the bank did not respond promptly enough, Treasury said.

A suspicious transaction is not a criminal conviction

The findings concern the bank’s legal responsibility to identify and report warning signs. They do not establish that every transaction included in the $5 billion figure involved a crime.

FinCEN has explained that suspicious activity reports provide investigative leads. A report may prompt authorities to investigate, but it does not itself prove wrongdoing by an account holder.

Under federal reporting regulations, banks generally must report qualifying transactions involving at least $5,000 when they know, suspect or have reason to suspect specified unlawful or unexplained activity.

That includes transactions potentially involving illegal proceeds, attempts to evade reporting rules or activity lacking an apparent lawful purpose after examination.

Banks generally have 30 calendar days after detecting facts that may justify a report to submit it. An additional 30 days may be available when no suspect has been identified.

For violations requiring immediate attention, such as an ongoing money-laundering scheme, the rules also require immediate notification to appropriate law enforcement.

These obligations allow investigators to receive warning signs before a bank can establish exactly what happened. Waiting for proof of a completed crime would undermine that reporting function.

The earlier order placed responsibility on the board

The December 2024 order also established responsibilities for Bank of America’s directors.

Under the full OCC order, the board had to establish a compliance committee. A majority of its members were required to be directors who were not employees or officers of the bank or its affiliates.

The order required progress reports identifying completed corrections, remaining problems and the people responsible for addressing them. It also directed the board to ensure the bank had enough qualified personnel, effective controls and resources.

Ultimately, the full board remained responsible for compliance with the order. Directors were required to verify that corrective measures worked and hold management accountable for carrying them out.

Those requirements make Tuesday’s findings a test of the bank’s governance as well as its technology. Regulators had already assigned responsibility for the repairs and required a process to track their completion.

A related monitoring problem reached Merrill Lynch

The latest action follows another enforcement case involving Bank of America’s transaction-monitoring system.

On June 29, the Securities and Exchange Commission announced a separate $7.5 million settlement with Merrill Lynch. The agency said the Bank of America subsidiary failed to file numerous suspicious activity reports between April 2020 and September 2024.

The SEC’s findings described how the monitoring software grouped alerts and assigned risk scores. Groups reaching 20 points became investigative cases; groups below that threshold generally did not.

However, internal analyses showed that some lower-scoring groups would have warranted suspicious activity reports if investigators had examined them.

The SEC also found that older events could leave the system without investigation after 13 months if their group had not become a case. Merrill remained responsible for its reporting obligations even though it relied on its parent company’s monitoring program.

Merrill settled that proceeding without admitting the findings, apart from jurisdiction. That differs from Bank of America’s admission in Tuesday’s FinCEN resolution.

Sanctions screening failed in hundreds of instances

The separate OFAC settlement covers 475 apparent sanctions violations involving programs targeting Russia, Belarus, Iran, Myanmar, Somalia, narcotics and global terrorism.

OFAC said problems included payments involving blocked banks, delayed updates to sanctions watchlists and improper handling of business accounts connected to blocked people. The agency classified the case as non-egregious but said most apparent violations were not voluntarily disclosed.

Its detailed enforcement release described a particularly consequential screening defect: alerts for customers whose names and birth dates exactly matched sanctioned individuals received low or medium priority.

Another problem involved a payment-routing directory that included blocked banks. OFAC said Bank of America became aware of that issue in March 2022, following sanctions imposed over Russia’s invasion of Ukraine.

Nevertheless, the bank processed 403 transactions totaling approximately $14.34 million through 35 blocked banks between February 2022 and March 2025.

OFAC also said incomplete responses and delays slowed its investigation. The agency gave the bank no net reduction from the base penalty for cooperation or remedial measures.

Related coverage: Bank of America’s earlier $12 million CFPB fine over mortgage reporting

Bank of America says it has invested billions in compliance

Bank of America acknowledged responsibility while pointing to investments it says are already underway.

“Financial crime compliance is serious, and we are responsible for getting it right,” the bank said in a statement published by Business North Carolina.

The bank said it had invested billions of dollars in technology and assigned thousands of employees to combat financial crime. It also said work to address regulators’ concerns was well advanced.

Additionally, the company said it supports thousands of law enforcement investigations and files hundreds of thousands of suspicious activity reports annually. Personnel and other resources devoted to the ongoing repairs are already reflected in its expense base, according to the statement.

Separately, Reuters reported that the bank expects a nondeductible $1.2 billion charge against third-quarter results. The company said that would reduce net income by approximately 17 cents per share.

Bank of America’s earnings conference call is scheduled for Wednesday, Oct. 14, at 8:30 a.m. Eastern.

The transaction review could continue into 2028

Under the new FinCEN consent order, Bank of America must propose an independent consultant within 60 days and hire the consultant within another 30 days, at its own expense.

The review covers specified activity beginning in January 2022 and continuing until the relevant monitoring problems are corrected. FinCEN retains authority to reject an unsuitable consultant and adjust the review’s scope.

The consultant must provide quarterly progress reports. A final findings report is due within 18 months of the scope report and no later than December 2028.

The bank then has up to 90 days to finish filing the suspicious activity reports identified through that review.

Separately, testing of the redesigned monitoring system must begin no later than October 2027. Those deadlines establish checkpoints for determining whether the repairs work and whether previously missed transactions finally reach investigators.