Across corporate America, a quiet retrenchment is under way. Compliance budgets are being flattened or trimmed, headcount is being “optimized,” chief compliance officers are being moved further from the executive suite, and programs built over a decade are being described as overhead to be right-sized. The justification is usually the same: the enforcement climate has changed, so the risk has changed. The Bank of America...

The first four posts in this series described what went wrong. This one asks what Bank of America is required to do now, how its cooperation and remediation were treated, and what a compliance officer at any institution should do on Monday morning. What the Bank Must Do Under the FinCEN consent order, the bank must work with a third party to complete a lookback...

On the same day that FinCEN and the OCC announced their penalties, OFAC announced its own: $11,662,930 for 475 apparent violations arising from sanctions screening failures between September 18, 2021 and April 24, 2025. The total value of the apparent violations was approximately $14.8 million. For a bank of this size, the dollar amount is modest. What makes the case important is the base penalty...

The most uncomfortable part of FinCEN’s consent order is not the technology. It is the story of what happened when the bank’s own compliance staff concluded that two high-revenue customers were too risky, and the business pushed back. FinCEN uses this history to support its findings on customer due diligence, to establish that management knew of the problem, and to explain why it weighted financial...

The core of FinCEN’s case against Bank of America is a single system. The bank’s proprietary transaction monitoring platform, called Event Processor (EP), was its primary control for identifying and reporting suspicious activity. FinCEN’s consent order describes, in unusual detail, how that system was built, what the bank’s own testing said about it, and why the problems persisted for years. For compliance officers, it is...

On October 13, 2026, the Treasury Department announced what it called the third-largest penalty in its history. Three bureaus, FinCEN, the OCC, and OFAC, resolved overlapping investigations of Bank of America, N.A., the second-largest bank in the United States, in a single coordinated announcement. The headline number is more than $1.21 billion. The structure behind that number, and the admissions attached to it, matter at...