The most uncomfortable part of FinCEN’s consent order is not the technology. It is the story of what happened when the bank’s own compliance staff concluded that two high-revenue customers were too risky, and the business pushed back. FinCEN uses this history to support its findings on customer due diligence, to establish that management knew of the problem, and to explain why it weighted financial...

The core of FinCEN’s case against Bank of America is a single system. The bank’s proprietary transaction monitoring platform, called Event Processor (EP), was its primary control for identifying and reporting suspicious activity. FinCEN’s consent order describes, in unusual detail, how that system was built, what the bank’s own testing said about it, and why the problems persisted for years. For compliance officers, it is...

On October 13, 2026, the Treasury Department announced what it called the third-largest penalty in its history. Three bureaus, FinCEN, the OCC, and OFAC, resolved overlapping investigations of Bank of America, N.A., the second-largest bank in the United States, in a single coordinated announcement. The headline number is more than $1.21 billion. The structure behind that number, and the admissions attached to it, matter at...

If your sanctions program is still the 2019 version, it’s missing the last seven years of enforcement. OFAC’s 2019 framework is still your foundation: management commitment, risk assessment, internal controls, testing, and training. But DOJ, Commerce, and Treasury have layered new expectations on top of that through joint Tri-Seal Notes. Four of them should be on your list today. One, U.S. nexus now reaches foreign...