BofA fined $1.21B for failures it agreed to fix in 2024

By Brett Rowland
The Center Square

Federal regulators fined Bank of America $1.21 billion Tuesday after finding it failed to quickly report more than $5 billion in suspicious transactions and relied on others to catch what its own systems missed.

The $1.2 billion assessed by Treasury’s Financial Crimes Enforcement Network includes a $750 million penalty from the Office of the Comptroller of the Currency, the largest in the agency’s history, the OCC said. The penalty will be paid to the U.S. Treasury. The Office of Foreign Assets Control separately settled 475 apparent sanctions violations with the bank for $11.6 million.

Treasury didn’t immediately respond to questions from The Center Square on Tuesday afternoon.

OCC examiners reviewing a small sample of accounts in the bank’s $102 billion credit card portfolio found 10 showing signs of potential trade-based money laundering. At the agency’s request, Bank of America reviewed those accounts and filed suspicious activity reports covering hundreds of millions of dollars in transactions in five of them. Absent the OCC’s request, the order states, “there is no indication that the Bank would have reviewed these accounts or filed these SARs.”

Between 2019 and 2023, bank management including the then-Bank Secrecy Act officer received written reports showing Bank of America was failing to file suspicious activity reports on 18% to 44% of potentially suspicious activity that was never referred for investigation, depending on the year. By 2024, the backlog of cases awaiting investigator review peaked at nearly 200,000.

The Bank Secrecy Act requires banks to file suspicious activity reports when they know or suspect a transaction involves criminal activity. Those reports go to FinCEN and feed federal investigations into drug trafficking, sanctions evasion and terrorist financing.

Treasury said the bank allowed suspicious activity to accumulate uninvestigated for extended periods, “resulting in late reporting of limited utility to law enforcement.”

More than $1 billion of the unreported activity involved national security and other priority risks, Treasury said, including transactions indicative of Chinese money laundering networks, fraud and potential trade-based money laundering with what the department called “a substantial nexus to the southwest border.”

Bank of America signed a cease-and-desist order with the OCC in December 2024 committing to fix the same compliance problems. The agency found Tuesday that the bank had not done so.

“Despite its obligation to the American people as a national-chartered, global systemically important bank, the bank’s BSA/AML (anti-money laundering) compliance program continues to reflect widespread breakdowns in internal controls, which threatens U.S. national and economic security,” Comptroller of the Currency Jonathan V. Gould said. “The bank’s poor response to its BSA deficiencies is unacceptable.”

Brian Moynihan, Bank of America’s chair and chief executive, signed the 2024 order committing to fix the deficiencies. He signed Tuesday’s penalty order as well.

“Financial crime compliance is serious, and we are responsible for getting it right,” a Bank of America spokesperson said in an emailed statement to The Center Square. The bank said it has invested billions of dollars in technology and assigned thousands of employees to combat financial crime, and that it is “far along with and committed to completing the work required to address the issues raised by our regulators.” It said it supports law enforcement across thousands of investigations and files hundreds of thousands of suspicious activity reports each year.

Bank of America said the penalties will result in a non-tax-deductible charge of $1.2 billion in its third-quarter results, reducing net income by about 17 cents per share. The bank said remediation costs are already in its current expense base.

The FinCEN order requires Bank of America to hire a third party to go back through its records and identify suspicious transactions it never reported. The bank must also submit to independent reviews of its transaction monitoring, customer due diligence and foreign correspondent account programs, and of the data governance behind them.

Treasury said those reviews will evaluate the bank’s handling of three priority risks: the southwest border, cartels and potential narcotics trafficking; Iran; and Russia.

The OCC also found that Bank of America sent outgoing wire transfers with inaccurate sender information, which the order said potentially harmed law enforcement’s ability to know who sent the money.

Between November 2021 and October 2024, the bank processed roughly 33,300 such wires totaling about $1 billion. The bank identified the problem itself in April 2024 and stopped the practice that year, but does not know how long it had been going on.