A Record Enforcement Action With a Clear Compliance Message
On October 13, 2026, the U.S. Department of the Treasury announced more than $1.21 billion in penalties against Bank of America for violations involving anti-money laundering and sanctions requirements.
The enforcement actions included a $1.2 billion penalty assessed by the Financial Crimes Enforcement Network (FinCEN), a $750 million civil money penalty assessed by the Office of the Comptroller of the Currency (OCC), and an $11.6 million settlement with the Office of Foreign Assets Control (OFAC).
At the center of FinCEN’s action was a significant failure to identify, investigate, and file suspicious activity reports (SARs). Bank of America did not report more than $5 billion in suspicious transactions in a timely manner, including activity linked to Chinese money laundering networks, fraud, potential trade-based money laundering, and illicit finance connected to the Southwest border.
The Treasury’s findings also identified weaknesses in transaction monitoring, customer due diligence, and how the bank handled escalating red flags. Suspicious activity accumulated without timely investigation, while the bank relied too heavily on external referrals rather than its own internal controls to identify potential financial crime.
Transaction Monitoring Must Identify More Than Obvious Red Flags
Transaction monitoring is a critical component of an effective anti-money laundering/countering the financing of terrorism (AML/CFT) program. For money services businesses (MSBs), it helps identify unusual activity and patterns that may indicate money laundering, fraud, or the financing of terrorism, as well as transactions that warrant further investigation.
The Bank of America case highlights the risks of monitoring systems that fail to account for an institution’s actual risk exposure. The Treasury reported that the bank’s monitoring system did not adequately address its risks and that it made no meaningful improvements despite testing that identified deficiencies.
Effective monitoring should help MSBs identify warning signs such as:
- Unusual transaction patterns: Activity that differs significantly from a customer’s established behavior or stated business purpose.
- Potential structuring: Transactions that appear designed to evade applicable reporting or recordkeeping requirements.
- Unexplained third-party activity: Payments involving individuals or entities whose relationship to the customer or purpose of the transaction is unclear.
- Geographic or counterparty risks: Activity involving higher-risk locations, unusual payment routes, or counterparties that warrant additional scrutiny.
- Repeated red flags: Patterns that may appear less concerning individually but become suspicious when evaluated collectively.
No single indicator automatically establishes that money laundering has occurred. The goal is to identify activity that warrants appropriate review, evaluate it in context, and take action based on the available facts.
Technology can support this process, but it is not a substitute for effective oversight. Monitoring rules, thresholds, data quality, alert handling, and investigative procedures should be tested and reviewed to determine whether they are identifying the risks the business is expected to detect.
Identifying Suspicious Activity is Only Half the Job
A monitoring alert does not fulfill an MSB’s reporting obligations by itself. Once a potentially suspicious transaction is identified, the business must review the facts, document its findings, escalate concerns when appropriate, and determine whether a SAR is required.
According to the enforcement announcement, Bank of America allowed suspicious activity to accumulate without investigation for extended periods. The resulting late reporting limited the usefulness of information provided to law enforcement.
The SAR rule, 31 CFR § 1022.320 generally requires reporting when a transaction conducted or attempted by, at, or through the business involves or aggregates at least $2,000 and the applicable suspicion criteria are met. Required SARs generally must be filed within 30 calendar days after initial detection of facts that may constitute a basis for filing.
This makes the quality and timeliness of an MSB’s investigation process essential.
A sound SAR workflow should address three fundamental questions:
- Was the activity adequately investigated? Review the relevant transactions, customer information, historical activity, and available supporting records.
- Was the filing decision appropriate? Apply the applicable reporting criteria to the facts and document the rationale for the decision.
- Was the SAR filed on time and supported by adequate documentation? Meet applicable deadlines, retain supporting records, and maintain SAR confidentiality.
Decisions should not be delayed indefinitely while an institution waits for law enforcement, another financial institution, or an outside party to identify the same concerns. The Treasury’s findings reinforce the importance of maintaining effective internal controls and acting on meaningful red flags.
A Risk-Based AML/CFT Program Requires Ongoing Oversight
The enforcement action also demonstrates why transaction monitoring cannot operate in isolation. Customer due diligence, employee training, independent reviews, and management oversight all contribute to an effective compliance program.
Treasury reported that Bank of America’s customer due diligence processes did not adequately account for customers’ extensive reliance on payments from unknown third parties. It also identified failures to respond meaningfully to mounting red flags, including concerns raised internally by compliance personnel.
For MSBs, this reinforces several practical priorities:
- Keep customer risk profiles current
- Review monitoring effectiveness
- Resolve alerts promptly
- Train employees to recognize and escalate concerns
- Use independent reviews to identify weaknesses
An effective program is not defined solely by the number of alerts generated or SARs filed. It is defined by whether the business can identify relevant risks, investigate suspicious activity appropriately, make sound reporting decisions, and demonstrate that its controls are working.
The Takeaway for MSBs
The Bank of America enforcement action involves a financial institution operating at a scale very different from most MSBs. However, the compliance lessons are directly relevant to businesses responsible for detecting and reporting suspicious activity.
Transaction monitoring must lead to meaningful investigations, investigations must lead to informed decisions, and when a SAR is required, it must be filed accurately and on time.
MSBs should use this enforcement action as an opportunity to assess whether their monitoring systems reflect their actual risk exposure, whether alerts are being resolved promptly, and whether their SAR procedures meet applicable requirements.
A written policy alone cannot protect a business from the consequences of ineffective controls. A risk-based, well-maintained AML program supported by appropriate technology, trained personnel, documented procedures, and ongoing oversight is essential to meeting regulatory obligations and helping prevent financial services from being misused for illicit purposes.
Is your transaction monitoring program keeping pace with your risks?
If you would like to chat with an expert about strengthening your AML/CFT program, assuring your transaction monitoring rules are set correctly for your risk, need an independent review, or would like to know the overall health of your compliance, contact us.
Tags: AML, AML/CFT Program, Anti Money Laundering, CFT, Countering the Financing of Terrorism, Financial Crimes Enforcement Network, FinCEN, Independent Review, Money Services Business, MSB, OCC, OFAC, Office of Foreign Assets Control, Office of the Comptroller of the Currency, Risk Assessment, SAR, Suspicious Activity Report, Third Party Independent Reviews, Transaction Monitoring
