Bank of America Hit With $1.21 Billion in US Penalties Over Money Laundering and Sanctions Failures: What the Orders Say

FinCEN fined Bank of America $1.2 billion (including a record $750 million OCC penalty) for willful Bank Secrecy Act violations, and OFAC added $11.66 million for 475 sanctions violations. What the orders found, our calculations, and what it means for crypto firms' access to banks.

Oct 18, 2026 - 12:28

Updated: 9 days ago

Bank of America Hit With $1.21 Billion in US Penalties Over Money Laundering and Sanctions Failures: What the Orders Say

Comic-style illustration of a golden gavel on stacks of cash in front of the US Treasury, with a magnifying glass over a transaction ledger and a penalty notice

Published October 18, 2026 (Treasury, FinCEN, OCC and OFAC actions of October 13, 2026).

Key takeaways

More than $1.21 billion in US penalties: the US Treasury announced on October 13 that Bank of America will pay a $1.2 billion FinCEN penalty for willful Bank Secrecy Act (BSA) violations and an $11.66 million OFAC settlement for 475 apparent sanctions violations. Treasury calls it the third-largest penalty in its history.
The OCC's record fine is inside the FinCEN figure: the Office of the Comptroller of the Currency imposed a $750 million civil money penalty, the largest in its history, but FinCEN credits it against its own $1.2 billion fine. The two amounts are not added together.
What FinCEN found: from at least January 1, 2018 through July 1, 2025, the bank missed or delayed the reporting of over $5 billion of suspicious activity, including about $1 billion linked to priority risks such as Chinese money laundering networks, fraud and trade-based money laundering. A 2024 lookback found nearly 8,900 suspicious activity reports (SARs) never filed, covering nearly $4 billion.
Why it matters for crypto: one day later, the OCC's own debanking report said many large banks restricted digital asset firms, often citing financial crime concerns. A record AML penalty on the second-largest US bank shows the compliance pressure behind that caution.

The three penalties at a glance

Agency	Amount	Legal basis	Period	Key finding
FinCEN	$1.2 billion	Willful violations of the Bank Secrecy Act (consent order)	Jan 1, 2018 to Jul 1, 2025	Over $5 billion of suspicious activity missed or reported late
OCC	$750 million (credited against FinCEN)	12 CFR 21.21 (BSA/AML program) and 12 CFR 21.11 (SARs)	Including conduct more than a year after the December 2024 order	Monitoring system failed to properly cover "trillions of dollars" of transactions
OFAC	$11,662,930	Sanctions regulations (Russia, Belarus, Iran, Burma, Somalia, narcotics, terrorism)	Sep 18, 2021 to Apr 24, 2025	475 apparent violations worth about $14.83 million
Total	About $1.21 billion	$1.2 billion (FinCEN, including the OCC's $750 million) + $11.66 million (OFAC)

Table compiled by BullishStation from the Treasury press release, the FinCEN consent order, OCC News Release 2026-89 and the OFAC enforcement release, all dated October 13, 2026.

Our calculations: what the numbers mean

Net FinCEN payment: because the OCC's $750 million is credited, the extra amount owed under the FinCEN order is about $450 million ($1.2 billion minus $750 million). Neither agency states this figure; it is our arithmetic.
Missed SARs: nearly $4 billion spread across nearly 8,900 unfiled reports is an average of about $449,000 per missing report.
OFAC ratio: the $11.66 million settlement equals about 79% of the $14.83 million of transactions involved. OFAC applied no reduction to the base penalty and noted that it had sent prior cautionary letters about similar conduct.
Scale: for comparison, FinCEN's penalty against Binance in November 2023 was $3.4 billion, and its penalty against TD Bank in October 2024 was $1.3 billion.

What the regulators found

FinCEN: willful Bank Secrecy Act violations

According to the FinCEN consent order, Bank of America failed to run a compliant anti-money laundering program, to carry out due diligence on correspondent accounts for foreign financial institutions, and to file suspicious activity reports on time. Over $600 million of transactions showed signs of trade-based money laundering involving salvaged vehicles, about one-third with a nexus to the US southwest border. Hundreds of millions of dollars matched a Chinese money laundering network typology.

The order also describes how changes to alert thresholds and rescoring logic affected investigations: the bank estimated its revised thresholds would add about 16,000 US investigations per month, and about 150,000 groups of events were affected by the rescoring logic. Among the case examples, FinCEN cites a 2022 investigation into a website that directed people to buy virtual currency and wire funds into a customer account, which the bank later determined had been compromised.

OCC: a program still deficient after the 2024 order

The OCC says the bank's transaction monitoring system failed to properly monitor trillions of dollars of transactions, that it filed many late SARs involving billions of dollars, and that its BSA staff lacked sufficient skills and training. More than a year after the December 2024 cease-and-desist order, the bank still had not escalated potentially suspicious activity, and a systemic monitoring gap let potential trade-based money laundering transactions go through. Comptroller Jonathan V. Gould called the bank's response to its BSA deficiencies "unacceptable." The OCC did not announce a new order or an asset cap.

OFAC: sanctions screening failures

OFAC found payments routed through blocked banks, poorly calibrated screening alerts, delayed watchlist updates and mishandled accounts linked to blocked persons. It judged the case non-egregious, but 413 of the 475 apparent violations were not voluntarily self-disclosed. OFAC listed Bank of America's size and sophistication, harm to sanctions programs including those on Russia, and earlier cautionary letters as aggravating factors.

Why this matters for crypto

On October 14, the OCC published its final debanking review of the nine largest US national banks. It found that many of them placed restrictions on digital asset activities, often attributing them to financial crime considerations. The Bank of America case shows the other side of that story: the same regulator, with FinCEN, has just imposed its largest-ever penalty for a weak anti-money laundering program.

For crypto companies, this creates a double signal. Washington is pushing banks to stop cutting off lawful businesses, as with the national trust bank charters granted to crypto firms. Yet banks face record fines when their monitoring fails, which gives compliance teams a strong reason to stay cautious with higher-risk clients. How banks balance those two pressures will shape access to dollar accounts for exchanges and stablecoin issuers.

The case also confirms the reach of Treasury's sanctions tools, which have recently targeted Iranian crypto funds and shadow banking networks. Sanctions screening failures at a major bank and crypto sanctions cases rely on the same OFAC programs.

What to watch next

The December 2024 OCC order: it remains in force. The OCC says the bank has not yet built an effective program; any termination of the order would be the clearest sign of progress. No date has been given.
OCC follow-up on debanking: the OCC says it will assess further changes to its regulatory and supervisory framework after its October 14 report, without a timeline.
Further enforcement: Treasury described the actions as part of its focus on priority threats such as Chinese money laundering networks and trade-based money laundering on the southwest border. Watch for similar cases against other large banks.
Bank of America's response: according to Banking Dive, the bank said it is far along with the work required by regulators and recorded a $1.2 billion charge in the third quarter.

FAQ

How much will Bank of America pay?

About $1.21 billion in total: a $1.2 billion FinCEN penalty, which includes the OCC's $750 million civil money penalty, plus an $11.66 million OFAC settlement.

Why is the OCC's $750 million not added to the total?

FinCEN credits the OCC penalty against its own fine. The OCC penalty is paid to the US Treasury, and the remaining FinCEN amount is about $450 million by our calculation.

What period does the case cover?

FinCEN's findings cover January 1, 2018 to July 1, 2025. The OFAC violations run from September 18, 2021 to April 24, 2025. The OCC also cites conduct more than a year after its December 2024 order.

Is crypto involved in the Bank of America case?

Not as a central issue. The OFAC release does not mention virtual currency. The FinCEN order mentions one 2022 case example involving a website that directed people to buy virtual currency and wire money into a compromised account.

Is this the largest FinCEN penalty ever?

No. Treasury calls the overall action the third-largest penalty in its history. FinCEN's penalties against Binance ($3.4 billion, 2023) and TD Bank ($1.3 billion, 2024) were larger.

What does this mean for bank accounts of crypto firms?

Nothing changes directly. But record AML fines give banks reasons to stay cautious with clients they see as higher risk, at a time when the OCC is pressing them to avoid unjustified account closures.