On October 13, 2026, the Treasury Department announced what it called the third-largest penalty in its history. Three bureaus, FinCEN, the OCC, and OFAC, resolved overlapping investigations of Bank of America, N.A., the second-largest bank in the United States, in a single coordinated announcement. The headline number is more than $1.21 billion. The structure behind that number, and the admissions attached to it, matter at least as much as the dollar figure.

The Three Actions

FinCEN assessed a $1.2 billion civil money penalty (Consent Order No. 2026-03) for failures to mitigate and report priority national security risks, including Chinese money laundering networks and illicit finance along the southwest border. The OCC assessed a $750 million civil money penalty for a deficient and ineffective BSA/AML compliance program, the largest in the OCC’s history. OFAC announced an $11,662,930 settlement for 475 apparent violations of sanctions programs covering Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism.

The arithmetic is worth getting right, because some coverage has added these up incorrectly. FinCEN’s $1.2 billion includes credit for the OCC’s $750 million. The two are not stacked. Add the $11.66 million OFAC settlement to FinCEN’s figure and you reach the roughly $1.21 billion that Treasury and the bank both cite. Bank of America has said it will record a $1.2 billion, non-tax-deductible charge in the third quarter, about 17 cents per share.

The Admission That Matters Most

In the FinCEN consent order, Bank of America admits the statement of facts and admits that it willfully violated the Bank Secrecy Act by failing to implement and maintain an AML program meeting minimum requirements, failing to conduct required due diligence on correspondent accounts for foreign financial institutions, and failing to file suspicious activity reports on a timely basis.

Lawyers will notice a footnote. In civil BSA enforcement, “willful” means only that the institution acted with reckless disregard or willful blindness. The government does not have to show knowledge that the conduct was unlawful or any bad purpose, and the bank admits willfulness only in that civil sense. Even so, an admission of willfulness by a global systemically important bank is a significant event. It can be cited in private litigation, and it will be read by every other regulator, supervisor, and counterparty that deals with the bank.

What FinCEN Found

The order covers conduct from at least January 1, 2018 through July 1, 2025. FinCEN found that the bank failed to timely report more than $5 billion in suspicious activity, with roughly $1 billion implicating national security and other priority illicit finance risks. Those risks included activity indicative of Chinese money laundering networks, fraud, and potential trade-based money laundering with a substantial nexus to the southwest border. Treasury’s public statement put it bluntly: the bank effectively outsourced to third parties a substantial portion of its proactive detection and reporting obligations. By “third parties,” FinCEN means law enforcement, other financial institutions, and internal referrals, which drove more than one-third of the bank’s suspicious activity investigations for multiple years.

FinCEN identified failures in three of the BSA program’s required elements: internal controls (the transaction monitoring system), independent testing, and customer due diligence, plus a separate failure of due diligence for foreign correspondent accounts. The following posts in this series take each in turn.

The Starting Point: A 2024 Order

None of this arrived without warning. The OCC identified significant deficiencies in 2023 and issued a cease-and-desist order on December 23, 2024, which carried no monetary penalty but required the bank to validate its transaction monitoring system, conduct a lookback, and engage an independent consultant. The OCC’s new penalty addresses continuing violations. Comptroller Jonathan Gould called the bank’s response to its BSA deficiencies unacceptable and described widespread breakdowns in internal controls. FinCEN’s order adds a telling detail: as late as June 2025, a third-party report required by one of the bank’s prudential regulators still found issues with the bank’s monitoring system consistent with those FinCEN identified.

The sequence is the lesson. A prudential order without a penalty gave the bank a chance to fix the problem. Fixing it took longer than the regulators were willing to wait, and the later penalty was calibrated to a record.

What About DOJ?

You asked about the Justice Department, and I want to be precise. I found no DOJ resolution of any kind, no deferred prosecution agreement, plea, or declination, announced with these Treasury actions, and no Treasury or press description of one. What does appear is DOJ in the background of the FinCEN order: one of the bank’s online auto auction customers publicly disclosed in November 2023 that the Department of Justice was investigating it for potential money laundering violations relating to its anti-money laundering practices. FinCEN faults the bank for not changing that customer’s risk profile or monitoring in response to that public disclosure.

The order also notes that a Bank of America affiliate, Merrill Lynch, was subject to SEC actions for failing to file SARs in 2023 and on June 29, 2026, and that the 2026 SEC action involved missed SARs attributable to issues with the same transaction monitoring system. I cannot tell from the public record whether DOJ has any open inquiry into the bank itself, and I would not speculate. Readers should treat DOJ as unresolved and watch the bank’s SEC filings.

Where to Find the Documents

The FinCEN consent order is posted on FinCEN’s site (fincen.gov, file BoA-Consent-Order-Execution-Final.pdf). The OCC’s news release is NR 2026-89 on occ.gov. The OFAC enforcement release is dated October 13, 2026 and is on OFAC’s civil penalties page. Treasury’s press release is sb0657 on home.treasury.gov. I was able to read the full FinCEN order only through its Section on penalty factors (the copy available to me cut off at factor six), so statements here about cooperation credit and the final undertakings come from Treasury’s public description and press coverage, not the order’s closing pages.

Why This Is a Big Deal

Three things set this case apart. First, scale: the penalty is the OCC’s largest ever and the third largest in Treasury’s history. Second, the combination of a willfulness admission with specific findings about internal documents, including what compliance staff warned and what management did about it. Third, the direction of travel. Treasury’s statement links AML and sanctions compliance and says institutions should make sure those efforts are integrated and mutually reinforcing. Bank of America’s settlement with OFAC, resolving screening failures, arrived on the same day as its AML case. Regulators are telling the industry that a weak transaction monitoring program and weak sanctions screening are one program-wide problem, not two.