Opinion: Bank of America’s Penalties Must Produce Working Controls

What the release says

Treasury announced more than $1.21 billion in penalties involving FinCEN, the Office of the Comptroller of the Currency, and the Office of Foreign Assets Control.

FinCEN imposed a $1.2 billion civil money penalty but credited the bank’s $750 million OCC payment, leaving $450 million payable to Treasury under the FinCEN order. OFAC separately announced an approximately $11.6 million settlement.

Bank of America admitted the statement of facts and violations in FinCEN’s consent order, including failures involving its anti-money-laundering program, foreign correspondent-account due diligence, and suspicious-activity reporting.

FinCEN’s order says the bank missed or delayed reporting more than $5 billion in suspicious activity, including roughly $1 billion connected to national-security and other priority illicit-finance risks.

The release says OFAC resolved potential civil liability for 475 apparent sanctions violations. OFAC classified those apparent violations as non-egregious and largely not voluntarily self-disclosed.

The FinCEN order requires an independent lookback beginning with activity from January 2022, plus reviews of suspicious-activity monitoring, customer due diligence, correspondent-account controls, and relevant data governance.

Our centrist perspective

The penalty structure should be described carefully: the $1.2 billion FinCEN assessment and $750 million OCC penalty overlap through a credit, so simply adding every announced assessment would overstate the amount payable.

The admitted FinCEN facts point to a governance problem, not merely isolated employee error. Regulators described long-running weaknesses in transaction-monitoring design, escalation, testing, staffing, training, and responses to internal warnings.

The strongest part of the resolution is the independent lookback. It can recover missed reports, test whether repairs work on historical activity, and give regulators evidence beyond management assurances.

For customers, the immediate effect should be limited because the actions target the bank’s compliance systems, not ordinary account holders. Over time, better controls can protect the financial system, but remediation must avoid indiscriminate account closures or delays that substitute broad de-risking for accurate detection.

The tradeoffs

Large penalties can strengthen deterrence and signal equal enforcement against systemically important banks, but fines alone may be absorbed by shareholders and do not guarantee safer operations.

Lower monitoring thresholds can identify more suspicious activity, yet poorly calibrated systems can generate excessive false positives, overwhelm investigators, and burden legitimate customers.

Independent consultants can add expertise and credibility, though overlapping mandates from FinCEN and the OCC can increase cost and complexity unless regulators coordinate expectations.

More aggressive customer due diligence can reduce illicit-finance exposure, but blunt implementation could restrict services for lawful businesses, immigrants, charities, or customers operating across borders.

What to watch next

• Whether independent reviewers find additional reportable transactions and whether the bank files overdue suspicious-activity reports on schedule.
• Whether Bank of America shows sustained improvement in alert quality, investigation speed, staffing, training, and data governance rather than short-term increases in filing volume.
• Whether FinCEN and the OCC publish meaningful milestones demonstrating that the bank has satisfied the lookback and remediation requirements.
• Whether complaints, account closures, or payment delays rise in ways that suggest the bank is replacing risk-based compliance with indiscriminate de-risking.
• Whether senior management and the board tie compensation, budgets, and accountability to durable compliance results.