Bank of America's $1.2 billion BSA penalty traces back to one monitoring threshold

What happened

On 13 October 2026, the US Financial Crimes Enforcement Network (FinCEN) assessed a $1.2 billion civil money penalty against Bank of America, N.A. for willful violations of the Bank Secrecy Act (BSA). The Office of the Comptroller of the Currency (OCC) imposed a $750 million penalty, which it calls the largest in its history. FinCEN credited that amount, so the bank pays a further $450 million to the Treasury under FinCEN’s order. The Office of Foreign Assets Control (OFAC) separately settled 475 apparent sanctions violations for $11,662,930.

In FinCEN’s consent order, the bank admits it willfully failed to maintain an anti-money laundering (AML) program, to conduct due diligence on correspondent accounts for foreign financial institutions, and to file timely suspicious activity reports (SARs). The order covers at least 1 January 2018 to 1 July 2025. FinCEN found late or missing SARs on over $5 billion of suspicious activity. Over $1 billion of it involved Chinese money laundering networks, fraud, and potential trade-based money laundering (TBML) with a substantial nexus to the southwest border.

The core failure was Event Processor, the bank’s in-house monitoring system, first built in 2010. It scored alerts and grouped them by customer. A case reached an investigator only when a group hit 20 points within 13 months, a threshold “initially set by stakeholder judgment” that stayed in place until December 2023. After the bank lowered it, a one-time lookback found nearly $4 billion of suspicious activity that would not otherwise have been investigated and reported in time.

Two online auto auction customers received over $660 million in suspicious money order deposits, often three sequential money orders totalling between $2,900 and $3,000. Another customer, profiled with expected annual sales of $1 million to $4 million, processed over $700 million in wires involving high-risk jurisdictions over about three years.

Why it matters

The order points to design as the root cause. A model that adds up risk points, and counts some factors only once however often they fire, can hold back slow, repeated patterns such as the money order deposits above. FinCEN notes that for multiple years more than one third of the bank’s investigations did not start from its own automated alerts. They started from law enforcement referrals, subpoenas, other banks’ requests, or manual referrals.

The warnings were internal too. By September 2022, compliance staff had recommended closing one auto auction customer’s accounts. The bank waited two years to begin restricting its money order deposits. OFAC’s release describes a parallel failure in sanctions screening, where an “alert suppression rule” automatically released some payments involving blocked banks because a matching alert had once been closed as a false positive.

The undertakings set out where FinCEN will look next: a SAR lookback, independent reviews of suspicious activity monitoring, effectiveness testing of customer due diligence (CDD) and foreign correspondent due diligence, and a data governance review.

Practitioner angle

• Pull the documentation for each case-creation threshold and scoring weight, and record whether it rests on testing or on judgment. FinCEN’s order faults design choices that “lacked empirical support.”
• List every rule that suppresses, rescores, or auto-closes alerts, in transaction monitoring and in sanctions screening. Give each one an owner, a written rationale, and regular below-the-line testing.
• Measure the share of investigations triggered by subpoenas, information requests, or another bank’s inquiry. If that share is high or rising, your scenarios are probably missing activity.
• Check your coverage of money orders, other negotiable instruments, and credit card activity, all of which had limited coverage here.
• When compliance recommends closing a relationship and the business keeps it, document who decided and why.

Start by testing whether your case-creation logic would catch three sequential money orders just under $3,000, deposited again and again.