Bank of America’s $1.2 Billion AML Penalty: What the Records Actually Show

Bank of America was not criminally convicted of laundering $5 billion. On October 13, 2026, it agreed to a $1.2 billion civil penalty from the U.S. Treasury’s Financial Crimes Enforcement Network (FinCEN) and admitted facts and violations in an order saying the bank had willfully violated the Bank Secrecy Act. The core failure was that its anti-money-laundering controls repeatedly missed, delayed or failed to report suspicious activity. The order says the failures increased the risk that money could be laundered through the bank; it does not establish that the bank intended to launder criminal proceeds or that every customer transaction under scrutiny was criminal. (FinCEN’s release; executed consent order, pp. 1, 5, 59–64.)

Key judgments

• The headline is shorthand. This was a civil Bank Secrecy Act and anti-money-laundering compliance case, not a criminal money-laundering prosecution of Bank of America, N.A.
• The conduct was serious. The admitted record describes years of weak monitoring, poor customer-risk reviews, missed or late suspicious-activity reports, and failures that continued despite internal testing and outside warnings.
• The $5 billion figure is not proven dirty money. It is the value of suspicious activity that FinCEN says was not reported accurately or on time. The order does not say that $5 billion was proven criminal proceeds, bank profit, or a public loss.
• Some customer patterns look like familiar laundering risks. Money orders repeatedly just below an issuer’s identification threshold, third-party payments, high-risk cross-border wires, and unexplained trade flows can be indicators of structuring or trade-based laundering. Indicators justify scrutiny and reporting; they do not prove each customer’s guilt.
• An individual or small business could face prison for different, provable conduct. Knowingly moving criminal proceeds with the intent to promote or conceal crime, or deliberately structuring transactions to evade reporting, can be criminal. An ordinary depositor does not carry a bank’s general AML-program duty.

What the $1.2 billion covered

Three agencies announced coordinated actions. The amounts are easy to misread:

So the coordinated headline total is $1,211,662,930, or about $1.212 billion—not $1.2 billion plus another $750 million. Treasury’s release, the OCC announcement, and OFAC settlement notice set out the separate actions and credit.

The bank’s public response was that financial-crime compliance is its responsibility, it worked with regulators to reach the resolutions, and it had invested billions in technology and assigned thousands of employees to the work. That response belongs in the account. It does not undo the admitted FinCEN facts or the OCC’s separate findings. BofA’s third-quarter filing recorded the $1.2 billion regulatory settlement charge. (AP’s report including the bank’s statement; BofA’s SEC-filed results.)

The failure was in the screening and escalation system

Banks are required to maintain risk-based controls to detect suspicious activity and file reports with FinCEN. A bank generally has 30 days after initially detecting facts that may support a SAR to file it. A suspicious activity report is financial intelligence for investigators. It is not a criminal charge, and it does not declare the customer guilty. (FinCEN order, p. 3.)

Bank of America relied heavily on a proprietary alert system called the Event Processor. It gathered separate alerts about transactions and customers into groups, assigned points based on risk factors, and generally sent a group to an investigator only after it reached 20 points. The threshold was initially selected by “stakeholder judgment,” the order says, and remained in place until December 2023. Some risk factors carried low weights even when they were associated with high SAR yields; other alerts aged out of the 13-month scoring window before the group reached the threshold. (FinCEN order, pp. 8–15.)

The system was built partly to manage a volume of alerts that exceeded investigator capacity. That is a reasonable operational problem to solve. The failure was allowing the screen to become a bottleneck: weakly weighted signals did not add up, a rolling time limit could retire older alerts, and people often did not see the pattern soon enough. Internal tests identified performance problems, but FinCEN says the bank did not respond adequately. The OCC later reported that the investigator backlog peaked near 200,000 cases in 2024. (OCC order, pp. 3–4.)

This was not one missed alert. FinCEN’s order describes a feedback loop: the bank lacked capacity to review all alerts, used a scoring design to narrow the queue, failed to correct weaknesses that testing exposed, and then relied in part on law-enforcement inquiries and other outside prompts to surface risk. More than one-third of the bank’s investigations were triggered by these “promotion” events, many driven by external inquiries, rather than by its own core controls. When BofA later lowered the review threshold, a limited one-time look at groups that had scored below the old 20-point bar generated more than 8,000 SARs covering about $3.96 billion in previously unreported suspicious activity. That figure sits within the broader reporting failure and must not be added to the $5 billion total. The result was less timely financial intelligence for law enforcement. (FinCEN order, pp. 58–59, 60–61.)

Other defects made that loop worse. The orders describe shallow reviews of higher-risk customers, failure to compare actual transaction volumes with expected business activity, incomplete monitoring of money orders and other negotiable instruments, gaps in foreign correspondent-account due diligence, and inadequate staffing and training. The OCC also found that roughly 33,300 outgoing wires totaling about $1 billion carried inaccurate transmitter information, which could make it harder to identify who sent them. Those OCC findings were neither admitted nor denied by BofA. (FinCEN order, pp. 31–48, 50–64; OCC order, pp. 3–5.)

The chronology shows that the problem was not only a model. FinCEN says that by early 2020, the bank had years of investigations, alerts and law-enforcement inquiries concerning Customer B, yet kept its risk rating at “Standard” until a grand-jury subpoena arrived. BofA then raised the rating, but did not meaningfully change enhanced due diligence or ongoing monitoring. The order also describes internal investigations linking Customer A’s accounts to stolen checks, business-email compromise, elder fraud and other fraud schemes while the relationship remained open. These facts do not prove that the bank intended to launder proceeds. They do show that mounting warnings did not lead to timely changes in customer treatment. (FinCEN order, pp. 35–37.)

The timing of a particular wire pattern makes the reporting delay concrete. FinCEN says the activity exceeded $850 million; the bank’s first SAR in August 2023 covered only about 10 percent, and most of the activity was not reported until June 2025, after FinCEN information requests. Compliance staff had been aware of some transactions in late 2022. The order further says that after one auction customer publicly disclosed a DOJ investigation into potential money-laundering-law violations in November 2023, the bank took no meaningful steps to enhance monitoring of its activity. These are specific activity groups, not the entire $5 billion. The conduct FinCEN describes spans at least January 2018 through July 1, 2025. In December 2024, the OCC had already ordered the bank to correct earlier BSA deficiencies. The October 2026 OCC action says major failures persisted after that order. FinCEN also says it began to see meaningful remediation only after its own investigation and extensive regulator engagement. This turns the story from a defective model into a prolonged control and management failure. (FinCEN order, pp. 4–6, 35–37, 55–56, 59–64; 2024 OCC order; 2026 OCC release.)

What activity triggered the scrutiny

The order describes suspicious patterns, not a public verdict on each person who made a payment. Its central examples involve two anonymized online auto-auction customers and other customers with possible trade-based laundering indicators. The customers remain unnamed in the order; the public record does not justify guessing their identities.

Why do these patterns matter? Laundering schemes can move value by disguising the source or destination of proceeds. Buying vehicles with cash-like instruments and exporting them can turn money into a saleable asset that crosses borders. Trade-based laundering can use payments, invoices, goods, or business relationships to move value while creating a commercial explanation. Third-party payments and inconsistent business scale can obscure who supplied the money and why.

That is a coherent risk explanation, not proof that every transaction did those things. A vehicle exporter can have legitimate overseas buyers; money orders can be lawful; logistics and electronics companies can make complex payments. Regulators’ concern comes from the repeated combination of unusual scale, payment fragmentation, opaque counterparties, high-risk routes, and weak explanations—not any single trait such as geography or industry. FinCEN’s public advisory on Chinese money-laundering networks describes broader typologies, but a typology is not a finding about a named customer.

What “more than $5 billion in suspicious transactions” means

FinCEN says Bank of America failed to file timely and accurate SARs on suspicious activity involving more than $5 billion in transactions. Roughly $1 billion of that activity implicated priority illicit-finance risks, including activity indicative of Chinese money-laundering networks, fraud, and potential trade-based money laundering with a southwest-border nexus. (FinCEN order, pp. 5, 50–58.)

The number measures the value of transactions associated with the reporting failures. It is not a finding that $5 billion was stolen, drug money, or proven proceeds of a specified unlawful activity. It is not the bank’s profit from laundering, a customer loss, or a sum the government proved was laundered. The roughly $1 billion is a subset of the $5 billion figure, and the various risk categories overlap. Adding them would manufacture a larger total than the order establishes.

The point of a SAR is to give investigators timely information so they can connect transactions to other evidence. When a bank fails to report, it can delay investigations and make patterns harder to see across accounts or institutions. FinCEN says that is exactly the kind of intelligence gap the bank’s failures created. A SAR itself is not proof of a crime; missing or late SARs do not prove the underlying customer committed one either. For more on what SAR secrecy means to an account holder, see Sherafy’s guide to why a bank can close an account without explaining why.

Was Bank of America charged with money laundering?

Not in the October 2026 action described here. FinCEN issued a civil consent order for Bank Secrecy Act violations. The bank admitted those facts and violations, including “willful” violations as that term applies to civil BSA enforcement. The OCC’s order separately found BSA deficiencies, but the bank neither admitted nor denied those OCC findings. OFAC settled a sanctions matter involving apparent violations. None of those instruments is a criminal conviction of BofA for laundering proceeds.

“Willful” sounds like a criminal verdict, but it does not mean the same thing here. The FinCEN order says civil BSA willfulness can be established by reckless disregard or willful blindness; the government does not have to prove that the bank knew its conduct violated the BSA or acted with an improper motive. That standard supports a severe civil finding. It does not by itself prove the different knowledge and intent required for criminal money-laundering offenses.

Under 18 U.S.C. § 1956, a common federal money-laundering offense requires a financial transaction involving proceeds of specified unlawful activity, knowledge that the property represents unlawful proceeds, and a further statutory purpose or knowledge—for example, promoting the unlawful activity, concealing the proceeds, or avoiding a reporting requirement. One subsection carries a maximum of 20 years’ imprisonment. Section 1957 separately covers certain knowing transactions over $10,000 in criminally derived property and carries a maximum of 10 years. Those are statutory ceilings, not predictions about a real case.

The distinction is visible in a different bank case: in 2024, TD Bank pleaded guilty to criminal conspiracy offenses that included money laundering. That is a different institution, different record, and different legal resolution. It shows why a civil penalty and a criminal guilty plea should not be collapsed into the same label. (DOJ’s TD Bank announcement.)

The accurate conclusion is neither “the bank was convicted of laundering billions” nor “nothing more than paperwork went wrong.” Bank of America admitted a prolonged failure in the systems meant to identify and report suspicious activity, despite warnings and testing. FinCEN concluded the failures materially increased the risk that money could be laundered through the bank. The public order does not establish that the bank itself knowingly laundered specific criminal proceeds.

What could happen to an individual or small business?

It depends on what the person did, what they knew, what they intended, and whether they had a regulated financial role. “A small business did something suspicious” is not a charge or sentence.

An ordinary customer is not a bank. A person depositing legitimate proceeds, accepting a lawful third-party payment, or buying a vehicle with money orders does not become a money launderer merely because a bank later files a SAR or closes an account. Most ordinary businesses do not have the same general duty as a bank to run transaction-monitoring systems and file bank SARs.

A person who knowingly moves criminal proceeds can face criminal charges. If prosecutors can prove the proceeds came from a qualifying crime and the person knowingly conducted a transaction with the intent to promote that crime or to conceal the proceeds, §1956 can carry up to 20 years. A person who knowingly conducts a covered transaction over $10,000 in criminally derived property can face §1957, which carries up to 10 years. A business owner, bookkeeper, employee, or intermediary can be exposed based on their own conduct and proof of the required elements; owning or working for a small company does not create immunity.

Deliberately breaking up cash transactions can be a separate crime. Federal law prohibits structuring transactions for the purpose of evading covered reporting or recordkeeping requirements. The general maximum is five years, rising to ten years in specified aggravated cases. (31 U.S.C. § 5324.) A sequence of deposits or payments below a threshold can be evidence, but the amount alone does not establish the required purpose. The BofA order describes the money-order pattern as a red flag; it does not prosecute the anonymous buyers for structuring. Whether a particular transaction falls under §5324 requires proof of that statute’s elements. The $3,000 money-order issuer recordkeeping rule in the order is different from the bank currency-transaction reporting rule for cash transactions over $10,000. (31 C.F.R. § 1010.311.)

Some small businesses do have BSA obligations. A business that transmits money, or issues, sells or redeems money orders, may be a money-services business (MSB). Certain MSBs must register, maintain controls and file SARs when their transactions meet applicable rules. FinCEN warns that civil and criminal penalties may apply for willful violations of MSB SAR requirements. The separate criminal BSA statute, 31 U.S.C. § 5322, provides up to five years’ imprisonment for covered willful violations, and up to ten years in specified aggravated circumstances. A shop that only sells ordinary goods is not automatically an MSB; the actual services and regulatory definitions matter. (FinCEN’s MSB guide; MSB SAR requirements.)

Prosecution is not the only possible result, and prison is not automatic. A used-car dealer who pleaded guilty to laundering fraud proceeds through vehicle auctions and export received six months of home confinement, two years of supervised release, a $5,500 fine and forfeiture. In another case, a Baltimore dealer who pleaded guilty to deliberately structuring more than $2 million in deposits to evade reporting received 30 months in prison and forfeited assets; the government said the cash came from drug trafficking. (DOJ, 2022 case; DOJ, 2013 case.) These cases show the possible range and the central importance of knowledge, purpose, and proven facts. They are not a sentencing calculator.

The practical answer to “would they just get a fine or go to jail?” is: either can happen, and the conduct’s legal category matters. A regulated business’s compliance failure can bring civil penalties and remedial orders. An individual’s knowing role in moving criminal proceeds or intentionally evading reporting can bring criminal charges, prison, fines and forfeiture. A legitimate customer whose transactions merely resemble a red flag is not thereby guilty.

What the record establishes—and where it stops

The record establishes a serious institutional failure: for years, the bank’s main monitoring process did not reliably turn risk indicators into timely human review and reporting. FinCEN found that management focused on the resource burden of remediation and that the bank likely saved hundreds of millions of dollars in compliance expenditures it did not make. The order also says the bank retained high-risk, high-value customers despite compliance recommendations to terminate some relationships. Those are not merely software defects; they are decisions about controls, staffing, escalation and risk. (FinCEN order, pp. 60–64.)

The record does not establish that every flagged customer laundered money, that the anonymized auction customers were convicted, or that BofA intended to help criminals hide proceeds. The strongest evidence-based finding is more specific: BofA admitted willful civil BSA violations and failed to provide timely, accurate reporting on a large volume of suspicious activity; regulators said the deficiencies exposed the financial system to serious risk. That is a severe finding on its own. It should not be inflated into a criminal conviction the orders did not issue.

Method and currency note

This article is based on public enforcement orders and government records available through October 23, 2026. “Suspicious,” “indicative,” “potential,” and “apparent” preserve the agencies’ stated level of proof. Federal statutory maximums are not predictions of a particular sentence. This is a general explanation of U.S. federal law, not advice about a specific person or business.

References and Further Reading

Primary enforcement records

• FinCEN’s October 13, 2026 release — official summary of the $1.2 billion penalty and BofA’s FinCEN admissions.
• FinCEN’s executed consent order (PDF) — the principal record: admissions, system design, customer-activity examples, SAR failures and remedies.
• OCC’s October 2026 release and civil money penalty order (PDF) — OCC findings, separate order posture and the credit against FinCEN’s penalty.
• OCC’s 2024 consent order (PDF) — background on the earlier BSA corrective order.
• OFAC’s settlement notice — the separate settlement over 475 apparent sanctions violations.

Law and government guidance

• 18 U.S.C. § 1956 and 18 U.S.C. § 1957 — federal transaction-based money-laundering offenses.
• 31 U.S.C. § 5324 — structuring transactions to evade covered reporting or recordkeeping; 31 C.F.R. § 1010.311 — the bank currency-transaction reporting rule for cash transactions over $10,000.
• 31 U.S.C. § 5322 — criminal penalties for covered willful BSA violations; applicability and enhanced maximums depend on the statute’s conditions.
• FinCEN’s Chinese money-laundering network advisory — broader typologies; it does not establish guilt in this case.
• FinCEN’s MSB overview and MSB SAR guidance — business activities that can create BSA reporting duties.

Case comparison and response

• DOJ’s 2022 used-car dealer case and 2013 structuring case — concrete individual case outcomes; neither predicts another case.
• DOJ’s 2024 TD Bank guilty plea announcement — contrast showing a distinct criminal resolution involving another institution.
• AP’s report on the BofA action — includes the bank’s public response.
• Sherafy: Why Can a Bank Close Your Account Without Telling You Why? — related consumer explainer on account closures and SAR confidentiality.