The record penalty comes after the order

The Office of the Comptroller of the Currency on Tuesday imposed a $750m civil money penalty on Bank of America, N.A. for violations of the Bank Secrecy Act and its implementing rules, according to the agency's release. "This amount is the largest in OCC history," the release says. The penalty will be paid to the US Treasury.

The OCC said the bank's anti-money-laundering programme was deficient and ineffective. Its transaction-monitoring system failed to properly monitor trillions of dollars in transactions, the agency said, which led the bank to file large numbers of late suspicious activity reports involving billions of dollars, many with indicia of money laundering. The OCC said the bank knew for years that it was failing to escalate potentially suspicious activity to investigators and did not correct it, that its BSA officer and staff lacked sufficient skills and expertise, and that its audit function missed long-standing problems that examiners later found.

The penalty follows an order that was meant to fix those problems. The bank has been under a December 2024 cease-and-desist order, and the OCC said that more than a year later it still was not escalating potentially suspicious activity and had not completed many of the significant steps required, and that a gap in monitoring let it process potential trade-based money-laundering transactions. "The bank's poor response to its BSA deficiencies is unacceptable," said Comptroller of the Currency Jonathan V. Gould. "The second largest bank's egregious and continued BSA violations warrant the OCC imposing its largest CMP ever assessed against a bank." Banks without an effective programme, he said, "can expect swift and significant action from the OCC."

The Financial Crimes Enforcement Network assessed a separate $1.2bn penalty for the bank's failure to mitigate and report priority national-security risks, including Chinese money-laundering networks and illicit finance along the southwest border. Under its resolution with FinCEN, Bank of America admits that it wilfully violated the Bank Secrecy Act by failing to maintain a compliant programme, to conduct due diligence on correspondent accounts for foreign financial institutions and to file suspicious activity reports. The OCC says FinCEN's fine "credits the OCC's $750 million penalty". The Treasury puts the total at more than $1.21bn and calls the FinCEN fine the third-largest penalty in its history.

The Treasury's release adds detail. It says the bank failed to report more than $5bn in suspicious transactions to FinCEN in time, more than $1bn of it tied to national-security and other priority risks, and that its reliance on law-enforcement inquiries and requests from other banks meant it "effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations". It says the bank "prioritized its revenues and minimized the impact on its required compliance resources". FinCEN's consent order requires a third-party lookback to find and report transactions that went undetected, and independent reviews of the bank's suspicious-activity monitoring, customer due diligence, correspondent-account checks and data governance. "Today's actions send a clear message that even the biggest financial institutions are not above the law," Treasury Secretary Scott Bessent said.

The Office of Foreign Assets Control settled separately. Bank of America agreed to pay $11,662,930 over 475 apparent violations of sanctions programmes on Russia, Belarus, Iran, Burma, Somalia, narcotics and global terrorism between September 2021 and April 2025, worth about $14.8m in total, OFAC's enforcement release says. They involved payments routed through blocked banks, poorly prioritised screening alerts, slow watchlist updates and two business accounts linked to blocked persons. OFAC found the violations non-egregious but largely not voluntarily disclosed, and gave no reduction to the base penalty.

The bank says it is fixing the problems. "Financial crime compliance is serious, and we are responsible for getting it right," a spokesperson told Banking Dive by email, adding that its team is "far along with and committed to completing the work required to address the issues raised by our regulators". Banking Dive reported, citing the spokesperson, that third-quarter results include a non-tax-deductible charge of $1.2bn, roughly 17 cents a share, and that no asset cap was imposed.

The sums overlap. Because FinCEN's fine credits the OCC's, the bank is not paying $1.95bn; the FinCEN fine plus the OFAC settlement comes to about $1.21bn by our arithmetic, matching the Treasury's figure. What sets this case apart is the sequence. The 2024 order set the task, and the 2026 penalty is for not finishing it, which tells other banks under consent orders that the order itself is a deadline. Komposite has covered how sponsor banks absorb enforcement risk and how a charter shapes the obligations that come with it.