OCC Imposes $750 Million Assessment Against Bank of America for Deficient BSA/AML Compliance
AI Analysis
On October 13, 2026, the OCC imposed a record $750 million civil money penalty on Bank of America, N.A. for deficient and ineffective BSA/AML controls, including failures to monitor transactions, escalate potentially suspicious activity, file accurate and timely SARs, train BSA personnel, and maintain effective independent audit coverage. The action is especially significant because the deficiencies continued more than a year after a December 2024 cease-and-desist order, and the OCC penalty is credited against a coordinated $1.2 billion FinCEN assessment rather than being additive.
Key dates
- 2024-12-01
- The OCC issued the December 2024 cease-and-desist order requiring Bank of America to address deficient BSA/AML controls; the publication does not specify the precise day of issuance.
- 2026-10-13
- The OCC announced the $750 million civil money penalty and coordinated action with FinCEN.
Suggested considerations
- Compliance teams may wish to perform a documented gap assessment against 12 CFR 21.21 and 12 CFR 21.11, including transaction monitoring, customer and activity risk coverage, escalation procedures, SAR timeliness and accuracy, and recordkeeping.
- Banks should consider testing whether potentially suspicious activity is consistently escalated to appropriately skilled investigators and whether alert disposition processes can demonstrate timely decisions on SAR filing.
- BSA officers and relevant personnel should consider competency-based training covering suspicious-activity identification, investigation, SAR preparation, trade-based money laundering indicators, and escalation responsibilities, with evidence of completion and effectiveness testing.
- Internal audit and independent testing functions may wish to assess whether their scope, expertise, sampling, issue validation, and reporting are capable of detecting systemic BSA/AML weaknesses rather than merely confirming policy existence.
- Management and boards of directors should consider reviewing BSA/AML remediation governance, resourcing, milestones, risk acceptance, issue escalation, and the treatment of repeated or overdue corrective actions.
- Banks with material trade finance, correspondent banking, card, payments, or cross-border activity should consider targeted testing for trade-based money laundering typologies and transaction-monitoring coverage gaps.
- Institutions operating under a consent order or cease-and-desist order should consider independently validating that remediation is complete and effective, rather than relying solely on management representations or closure of project milestones.
- Compliance teams may wish to compare their control framework with the broader market reading of the action: industry reporting characterized the case as a record penalty driven by systemic and longstanding failures, while professional commentary on the evolving BSA/AML framework emphasizes the distinction between establishing an effective program and maintaining it in operation.
What changed
The publication is an enforcement action, not a new generally applicable rule or safe harbor. It establishes a major OCC enforcement precedent that persistent failures to implement an effective BSA/AML program after a formal supervisory order can result in exceptionally large penalties, including where deficiencies affect transaction monitoring, SAR escalation and filing, personnel competence, training, and audit effectiveness. The OCC identified failures involving monitoring of trillions of dollars in transactions, late SARs involving billions of dollars, and potential trade-based money laundering activity. FinCEN is separately requiring remedial action as part of its coordinated $1.2 billion assessment, while the OCC penalty is payable to the U.S. Treasury.
Compliance impact
The enforcement action signals severe supervisory consequences for widespread or systemic BSA/AML implementation failures, particularly where management has known about deficiencies or has failed to remediate them under a prior order. The OCC expressly linked the failures to late and inaccurate SARs, missed potentially suspicious activity, inadequate expertise and training, ineffective audit cover
Who is affected
Related regulations
References
AI-generated analysis. May contain errors or omissions — verify with the original OCC source before acting. Full disclaimer.
What the OCC said
The Office of the Comptroller of the Currency (OCC) today announced a $750 million civil money penalty against Bank of America, N.A. (bank), for violations of the Bank Secrecy Act and its implementing regulations, including 12 CFR 21.21 and 12 CFR 21.11. This amount is the largest in OCC history.
Published by OCC . Read the full notice at the source for the authoritative text.